Attribute Queries and AttributeQueryDescriptor in Metadata

[Lukas Hämmerle]

Hello all

We are currently testing some interoperability aspects of OpenAM
(ForgeRock) and Shibboleth. One issue we stumbled upon is that attribute
queries from a Shibboleth SP (e.g. using GakuNin's great AttributeQuery
plug-in or the resolvertest binary that comes with the SP) to the OpenAM
IdP fail at the OpenAM IdP.

We (and the OpenAM experts) suspect based on the error message that the
OpenAM IdP does not respond to the attribute query because the SP's
metadata does not include a RoleDescriptor of type
AttributeQueryDescriptor. This is defined in the "Metadata Extension for
SAML V2.0 and V1.x Query Requesters":
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-ext-query-os.html

Reading "2.6 Complex Type AttributeQueryDescriptorType" I understand
that for an SP to be allowed to make attribute queries to an IdP, it
would need an additional AttributeQueryDescriptor role descriptor
(addtionally to the SPSSODescriptor) containing an
AttributeConsumingService element. However, we don't have such role
descriptors in our metadata and still, the IdP responds to attribute
queries.

This raised the question, why does a Shibboleth IdP (v2 in our case)
respond to attribute queries even though the SP does not have
AttributeQueryDescriptor in its metadata? Did we misunderstand something
here?


Best Regards
Lukas

-- 
SWITCH
Lukas Hämmerle, Central Solutions
GÉANT Project Task Leader "Enabling Users"
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch