Attribute Queries and AttributeQueryDescriptor in Metadata

[Cantor, Scott]

On 7/22/15, 11:52 AM, "dev on behalf of Lukas Hämmerle" <dev-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch> wrote:



>This raised the question, why does a Shibboleth IdP (v2 in our case)
>respond to attribute queries even though the SP does not have
>AttributeQueryDescriptor in its metadata? Did we misunderstand something
>here?

We never really adopted that extension. From the earliest days, we were using queries in combination with SSO so we always relied on SPSSODescriptor for both.

Neither V2 nor V3 actually supports the extension. I was going to add it to V3 but it was going to be a fairly invasive change to be able to handle both roles and I eventually just parked it as not being worth much effort.

One of the issues around this was that adding the extension essentially meant duplicating a ton of metadata (meaning the keys), much like we had to do with the AA role on the IdP. We sort of decided that wasn't worth much effort since almost nobody would be able to actually remove the SP role (obviously), so it amounted to a ton of work for no benefit.

I wouldn't say ForgeRock's wrong by any means. It just hasn't really come up much.

-- Scott

>