How to refuse SP session when no attributes received?

[Tom Scavo]

On Mon, Mar 11, 2013 at 3:29 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Gernot Hassenpflug <gernot.hassenpflug at asahinet.com> [2013-03-11 06:33]:
>
>> After that, the SP attempts to connect to the IdP and do another
>> attribute query---it fails with a connect timeout.
>
> If the IDP does not support attribute queries it should not announce
> support for those in its SAML metadata. Or get the port opened and
> queries fixed, obviously.

Agreed.

> (If you rely on attributes always being pushed from IdPs, e.g. because
> all IdPs support SAML2, you could also disable the SP's attribute
> query plugin to avoid useless attribute queries when the IdP does not
> provide attributes in the first place.)

No, I wouldn't do that since it may break something else in the
future. This is clearly a problem at the IdP, either it supports
attribute query or it does not. If it always pushes attributes, it
should simply remove the AttributeService endpoint in its metadata (as
you suggest above) to avoid an unnecessary query in the event of no
attribute release.

Tom