Use of SOAP in SAML2 Attribute Query protocol

[Cantor, Scott]

> my goal was in fact to implement the Attribute Query protocol over the
> front channel, so that query and responses would be conveyed through the user's
> browser.

If you do that, you are in 99% of cases creating an SSO/authentication protocol without the actual bits and rules required to create a safe protocol. I have yet to see anybody suggest it in a manner that was appropriate.

-- Scott