Attribute Queries and AttributeQueryDescriptor in Metadata

[Eric Goodman]

On 7/23/15, 8:01 AM, "dev on behalf of Lukas Hämmerle" <dev-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch> wrote:
>>However, as you said, it's probably in the end an implementation 
>>decision as the way it currently is implemented in OpenAM is not wrong 
>>as I understand.

>No, I wouldn't consider it wrong. Technically we are, but in the end they're 
>not going to get anywhere standing on the spec against a lot of practice. 
>We'll likely both end up having to support both.

Pretty sure I'm off topic here, and this may be a question with no clear answer, but in the bug description (in OpenAM's JIRA) the text says:

	"...AttributeQuery requests should be accepted from all Service Providers that are part of the same Circle of Trust as Attribute Authority is."

Just to understand the scoping intent of this: is this implying that an SP that is allowed authentication against an IdP should also be allowed AA lookups against the same IdP (presuming the SP has an appropriate Subject to use), or is it more narrowly implying that the metadata element in the metadata shouldn't "by itself" prevent the request from being processed?

I.e., is the expectation that an SPs could still have AA "release filters" different from its SSO "release filters"? So SP1 might be allowed SSO and AA lookup, but SP2 only SSO (and not AA lookup). Or is it intended that SSO release should = AA release for the same Subject?

The question is really about intent, not the actual implementation in either product.

Thanks!

--- Eric