Fail on resolved RequestedAttribute isRequired=true

[Peter Schober]

* Stefan Santesson <stefan at aaa-sec.com> [2015-07-14 14:37]:
> Can you tell the Shib3 IdP to fail authentication if SP metadata
> lists an attribute as required, but the attribute filter policy does
> not release that attribute?

There are pathological cases (seemingly becoming more common with SaaS
vendors) where the SP pushed authorisation to the IDP, i.e., they
expect you to abort the transaction if the subejct isn't authorized to
access a given SAML SP (or maybe they charge you per unique subject,
even if the subject is unauthorized, something along those lines...)

Phrased that way the IDPV3 has new methods to fail "authentication"
(not literally) at the IDP if some criteria are [not] met,
incl. specific attributes being [not] set.

You probably could write such a check to be more generic, i.e., to
always fail if isRequired="true" attributes are not part of the set of
attributes to be released, but I would expect that to be quite a bit
of work, and still has the issues Leif and Tom where commenting on.
-peter