Fail on resolved RequestedAttribute isRequired=true

[Stefan Santesson]

Hi,

This might be a RTFM question, but I could not find the answer to it.

I¹ve got a question I can¹t answer.

Can you tell the Shib3 IdP to fail authentication if SP metadata lists an
attribute as required, but the attribute filter policy does not release
that attribute?

The tests I¹ve done concludes that Shib IdP does not fail auth in this
case. It delivers what the filer policy releases, disregarding that it
does not match a required attribute in metadata.

Personally I think this is OK. Out of the two options, it is better to
deliver what you can, rather than to return an error, and let the SP
decide whether it wants to fail or not.
But I have to try to answer the question I got.

/Stefan