Does mod_shib ever do AttributeQueries?

[Wessel, Keith]

Thanks, Tom, that's a good start. I already checked, and should have included in my earlier note: all of these on-campus SPs are doing SAML2 attribute queries, and I know they're all running SAML2-compliant 
SPs. So, that's one good thing.

I'm pretty sure we can get away with turning this off. I still can't figure out what would have caused these SPs to generate this tiny hand full of attribute queries. Is mod_shib smart enough, if it receives an assertion without any attributes, to try an attribute query? If so, this could have been a fluke when the post content from the IDP didn't make it through to the SPs a hand full of times.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Tuesday, April 15, 2014 11:51 AM
To: Shib Users
Subject: Re: Does mod_shib ever do AttributeQueries?

On Tue, Apr 15, 2014 at 12:36 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
>
> I can't explain why they're doing attribute queries at all, nor can the admins of the servers. Does mod_shib ever generate an attribute query to the IDP under the hood? If so, under what circumstances? Just trying to figure out if we'll break anything by turning this off.

There are two separate questions here. Since SAML1 doesn't support XML encryption, a typical SAML1 flow includes a back-channel attribute query. OTOH, attributes are almost always pushed by a SAML2 IdP (depends on the configuration, I suppose) so SAML2 attribute query is seldom necessary. Now, if a SAML2 IdP doesn't push the attributes the SP wants, the SP is likely to turn around and issue a (redundant) attribute query. So, if your IdP *always* pushes attributes, a SAML2 AttributeService endpoint is unnecessary and should be removed from metadata.

Bottom line: If you can get away with not supporting SAML1, you can probably avoid all back-channel exchanges.

PS. There are scores of SAML2 AttributeService endpoints in InCommon metadata (https://spaces.internet2.edu/x/W4DYAg)

Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net