Encode XML-data as an attribute

[Cantor, Scott]

> There is a existing web-service which can tell the application if a subject can
> act on an object. The answer to this query is not as simple as yes or no.
> XACML might perhaps be more appropriate, but SAML has been considered
> for this.

That would definitely be a misuse of SAML attribute queries (mainly because of the injection of the notion of an "object"). There was a hacky feature in SAML 1.1 that sort of fit this idea, but it was removed in 2.0.

> The call to the AA must be made from the application layer and not
> from the Shibboleth SP, because the SP will only know the subject and not
> the object. Furthermore, I do not think Shibboleth SP can combine two
> attributes into a new principal and send that one to the AA using the
> SimpleAggrigation.

No, not without writing code, but of course the application layer involves code too.

> The complex answer could in theory be broken down into different
> attributes, but the simplest way was to have them all in one attribute and
> reuse existing XML-parsers.

If it's not expected that anything but the custom code in the application would be handling the result, then yes, it's not as big a deal. I was advising as to interop.

-- Scott