Attribute Push with SAML2 Providers

[Tom Scavo]

On Tue, Aug 30, 2011 at 5:15 PM, Leung, Warren <wleung at it.ucla.edu> wrote:
>
> I was wondering what the best option was for configuring a SAML1/2 SP for
> pushing of attributes.  We currently have these SP's configured in our
> relying-party.xml like the documentation has them, but whenever we add new
> additional ones we have to restart our application server.
>
> Is there an alternative in configuring these SP's so we don't have to
> reload relying-part.xml

Warren, what is your policy wrt attribute push? (that policy, of
course, is echoed in the configuration)

A simple, default policy is the following:

SAML1: Never push attributes. Support attribute query or artifact (or
both, if necessary).

SAML2: Always push attributes. Always encrypt assertions for
end-to-end confidentiality. Do not support attribute query (indeed, do
not include an AttributeAuthorityDescriptor in metadata). Support
artifact if you must (but avoid it if at all possible).

Your original post suggested you have to support both SAML1 and SAML2.
Too bad. Life would be so much simpler if there were only SAML2 :-)

Tom