How to refuse SP session when no attributes received?

[Peter Schober]

* Tom Scavo <trscavo at gmail.com> [2013-03-11 10:12]:
> > (If you rely on attributes always being pushed from IdPs, e.g. because
> > all IdPs support SAML2, you could also disable the SP's attribute
> > query plugin to avoid useless attribute queries when the IdP does not
> > provide attributes in the first place.)
> 
> No, I wouldn't do that since it may break something else in the
> future. This is clearly a problem at the IdP, either it supports
> attribute query or it does not. If it always pushes attributes, it
> should simply remove the AttributeService endpoint in its metadata (as
> you suggest above) to avoid an unnecessary query in the event of no
> attribute release.

I was just saying that if you know you don't need queries now and
those timeouts are causing a problem you can disable them (short of
implementing local workarounds to modify a local copy the IdPs
metadata or whatever, until the IdP changes that, if that's even in
the cards.)
Maybe you can do that for a single relying party only, I'd have to
look at the documentation.
Also to my knowledge there's no deployment profile that even mentions
atteribute queries, e.g. http://saml2int.org (wheerever its new home
@ kantara is now). And should you later decide to enable queries again
its as simple as re-enabling the plugin, I'd think.
-peter