Attribute Queries and AttributeQueryDescriptor in Metadata

[Lukas Hämmerle]

On 22.07.15 18:28, Cantor, Scott wrote:
>> This raised the question, why does a Shibboleth IdP (v2 in our
>> case) respond to attribute queries even though the SP does not
>> have AttributeQueryDescriptor in its metadata? Did we misunderstand
>> something here?
> 
> We never really adopted that extension. From the earliest days, we
> were using queries in combination with SSO so we always relied on
> SPSSODescriptor for both.

Thanks for the (as usual) very quick and comprehensive reply.


> One of the issues around this was that adding the extension
> essentially meant duplicating a ton of metadata (meaning the keys),
> much like we had to do with the AA role on the IdP. We sort of
> decided that wasn't worth much effort since almost nobody would be
> able to actually remove the SP role (obviously), so it amounted to a
> ton of work for no benefit.

That seems to me a reasonable decision. Especially given that metadata
is becoming larger and larger.

There is now also an relevant issue on the Forgerock issue tracker:
https://bugster.forgerock.org/jira/browse/OPENAM-6407

However, as you said, it's probably in the end an implementation
decision as the way it currently is implemented in OpenAM is not wrong
as I understand.


Best Regards
Lukas


-- 
SWITCH
Lukas Hämmerle, Central Solutions
GÉANT Project Task Leader "Enabling Users"
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch