Faster version of resolvertest for fast attribute queries?

[Lukas Hämmerle]

Dear Shibboleth colleagues

In order to check whether a user can be deprovisioned (account checking
[1]) or whether a user's identity data (like surname if a woman married)
has changed, one can use SAML attribute queries* and a user's persistent
identifier (persistentId). With a Shibboleth SP this attribute query can
be performed using the SP-bundled resolvertest [2] binary.

As far as I understand resolvertest was in the first line designed for
testing purposes and is not fully supported. I assume it basically
initializes a complete instance of a Service Provider including the
configuration for attribute processing.

Therefore, execution of the resolvertest takes up a long time (several
seconds) and is therefore not well suited for mass-querying many
(hundreds of) accounts and it is also not well suited for time-critical
applications where a user has to wait until he gets a feedback.

Therefore, I was wondering whether somebody knows of another simple,
fast, standalone terminal application that could be used to make SAML
attribute queries with X.509 clientAuthentication and/or message
signing. Alternatively, a simple tool just making SOAP requests could
also be an option. Any idea?

I already found something from the SimpleSAML PHP colleagues [4] but
that script is not really standalone but requires SimpleSAML PHP.

Kind Regards
Lukas


* Provided the Identity Providers were configured to support the
peristentId principal mapping.


[1]
<https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAccountChecking>
[2]
<https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPresolvertest>
[3]
<http://www.switch.ch/aai/support/presentations/opcom-200909/AAI-OpCom-Account-Checking.pdf>
[4]
<http://code.google.com/p/simplesamlphp/source/browse/trunk/www/example-simple/attributequery.php>

-- 
SWITCH
Serving Swiss Universities
--------------------------
Lukas Hämmerle, Central Solutions
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch