May a shibboleth IdP deliver attributes for authZ without preceding authN ?

[Tom Scavo]

On Mon, Oct 10, 2011 at 8:14 AM, Markus Ludwig Grandpre
<markus.grandpre at uni-konstanz.de> wrote:
>
> Required attributes are defined in SP's metadata:
>
> <AttributeConsumingService index="1">
>  ...
> </AttributeConsumingService>

In an SPSSODescriptor element? That's not a correct use of that
element, I'm afraid. That's precisely why a RoleDescriptor of type
query:AttributeQueryDescriptorType was specified:

http://wiki.oasis-open.org/security/SstcSamlMetadataExtQuery

Cheers,
Tom