Attribute query with qualified principal name

[Cantor, Scott]

> Integrating our IdP with a vendor that makes a SAML authN request,
> followed by an attribute query for attributes.  The attribute query identifies
> the principal with a qualified name (username at alaska.edu
> <mailto:username at alaska.edu> ) as a "transient identifier" rather than
> username we use to authenticate and find records in our directories.  The
> result is an empty result for the attribute query.

They are not using a transient identifier, if they did, it would likely work.

> This is the first and only attribute query I've encountered; is there an obvious
> way to configure the IdP to successfully return attributes?  I suppose the
> transient identifier is from the principal in the authN SAML assertion, which
> the vendor specified as being a scoped, username at alaska.edu

Which is not a transient. If you want to support standalone queries using a user identifier, you can, but there's no V2 support for limiting that to a specific requester. Once it's possible to do, any SP can issue a query like that and get back data that happens to be in the release policy for that requester.

-- Scott