Fail on resolved RequestedAttribute isRequired=true

[Cantor, Scott]

On 7/14/15, 8:36 AM, "users on behalf of Stefan Santesson" <users-bounces at shibboleth.net on behalf of stefan at aaa-sec.com> wrote:
>
>Can you tell the Shib3 IdP to fail authentication if SP metadata lists an
>attribute as required, but the attribute filter policy does not release
>that attribute?

Not currently, I don't think. The only filter plugins that look at metadata have flags to control whether to release only required attributes, but that's about it.

I suppose they could conceivably throw exceptions in cases like that, but it would be awkward because the logic really runs over the actual attributes being filtered, not what the metadata says.

>Personally I think this is OK. Out of the two options, it is better to
>deliver what you can, rather than to return an error, and let the SP
>decide whether it wants to fail or not.
>But I have to try to answer the question I got.

Nominally, the intent of saying something's required is in fact to tell the IdP that it may as well fail because the app won't run. But we didn't implement that.

-- Scott