Attribute query with qualified principal name

[Cantor, Scott]

On 2/23/15, 9:36 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:

>>If you want to support standalone queries using a user identifier, you 
>>can, 
>>but there's no V2 support for limiting that to a specific requester. 
>>Once it's 
>>possible to do, any SP can issue a query like that and get back data 
>>that 
>>happens to be in the release policy for that requester.
>
>Is the implication here that in V3 there is support for limiting this to 
>specific requesters?

Depending on how scalable you need the policy to be. You can attach 
predicates (just read that as conditions, but I'm going to keep 
accidentally typing predicates, so best get used to it) to just about 
every object, including the decoders that do the mapping back to a user, 
so you can limit when they run. The example in the file is commented out 
but shows a rule based on the SP.

>At this point
>
>	https://wiki.shibboleth.net/confluence/display/IDP30/6.6+SAML+2+Attribute
>+Query
>
>is a little bit sparse on details :), but for now I'm just curious if 
>there actually are enhanced features in this area in v3.

https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfi
guration

Queries aren't the only case where these kinds of mappings have to be done.

-- Scott