SAML2 attribute query authentication for IdPv3

[Scott Koranda]

Hi,

I have deployed Shib IdPv3 3.x to use as a SAML2 attribute
authority. I have a number of Shib SPs that use an ePPN
asserted by an IdP to then query the IdPv3 attribute authority
for more attributes about the user (the attribute authority is
managed by a research organization). The IdPv3 is deployed in
the "normal" way for a backchannel configuration--it uses a
self-signed X.509 certificate as the key and for TLS.

I need to build out an AD FS 3 custom attribute store using
.NET 4.5 to do that same thing as the Shibboleth SPs and query
the attribute authority.

Most of that task is straightforward except for how the client
authenticates to the attribute authority. The issue is best
explained in this (unanswered) Stack Overflow post:

http://stackoverflow.com/questions/19125896/forcing-asp-net-webapi-client-to-send-a-client-certificate-even-when-no-ca-match

So far my experience is that I will not be able to have the
client to TLS authentication to the IdPv3 SOAP endpoint.

If I decide to try and instead have the client authenticate by
signing the attribute query, do I need to make any
configuration changes to the IdPv3 or will this "just work".

Thanks,

Scott K