Fail on resolved RequestedAttribute isRequired=true

[Leif Johansson]

On 2015-07-14 14:36, Stefan Santesson wrote:
> Hi,
> 
> This might be a RTFM question, but I could not find the answer to it.
> 
> I¹ve got a question I can¹t answer.
> 
> Can you tell the Shib3 IdP to fail authentication if SP metadata lists an
> attribute as required, but the attribute filter policy does not release
> that attribute?
> 
> The tests I¹ve done concludes that Shib IdP does not fail auth in this
> case. It delivers what the filer policy releases, disregarding that it
> does not match a required attribute in metadata.
> 
> Personally I think this is OK. Out of the two options, it is better to
> deliver what you can, rather than to return an error, and let the SP
> decide whether it wants to fail or not.
> But I have to try to answer the question I got.
> 
> /Stefan
> 
> 

I would agree with this.