Attribute Queries and AttributeQueryDescriptor in Metadata

[Cantor, Scott]

On 7/23/15, 6:59 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>
>Pretty sure I'm off topic here, and this may be a question with no clear answer, but in the bug description (in OpenAM's JIRA) the text says:
>
>	"...AttributeQuery requests should be accepted from all Service Providers that are part of the same Circle of Trust as Attribute Authority is."

I....would not use that term. It's not well defined.

The issue is basically to leverage the SPSSODescriptor role when evaluating metadata for a query requester.

>Just to understand the scoping intent of this: is this implying that an SP that is allowed authentication against an IdP should also be allowed AA lookups against the same IdP (presuming the SP has an appropriate Subject to use), or is it more narrowly implying that the metadata element in the metadata shouldn't "by itself" prevent the request from being processed?

I was going to say the latter, but you make a valid point.

>I.e., is the expectation that an SPs could still have AA "release filters" different from its SSO "release filters"? So SP1 might be allowed SSO and AA lookup, but SP2 only SSO (and not AA lookup). Or is it intended that SSO release should = AA release for the same Subject?

In Shibboleth, you're correctly inferring that you can't really authorize release separately in those two cases, apart from just not allowing use of a particular kind of NameID. You can't query with what you don't have, obviously.

So I would grant that yes there's a use case here involving authorization that could take advantage of the different role types, and we don't support that (and they could rightly argue they'd be breaking things by supporting the SP role).

But for us, obviously we'd have to get fancier with our policies to be able to make this distinction.

-- Scott