Use of SOAP in SAML2 Attribute Query protocol

[Cantor, Scott]

> I'm trying to use Shibboleth as an Attribute Provider using Attribute
> Query protocol and I noticed that it only supports SOAP binding. I searched the Internet
> for an alternative, considering that SAML Profile specifications only require a synchronous
> binding, but I found nothing.

A profile is an issue of interoperability, and SOAP is the only synchronous binding defined, ever, so that's what was used.

There are certainly people who have either speculated or outright implemented the idea of using Attribute Query over the front channel with a browser, and all the work composes well enough for that to be self-evident, but doing so ignores a variety of security issues that in the end result in almost every use case for it turning back into SSO anyway.
 
> Is there a reason why SOAP is the only supported binding for this profile?

Because the front channel wasn't interesting at the time, and there are no other back channel bindings in SAML.

-- Scott