Request attributes as a webservice without login/SSO

[Jehan Procaccia]

Hello,

we are setting a web base application in order to allow our futur 
students to subscribe to courses based on a shibboleth authN + authZ
the authZ (based on the attribute resolver on the IDP) is used to 
provision the student's record with their name, mail, organization 
origin ...
the combination of shibboleth IDP + SP does fullfill those needs .
However, lately , we want teachers to request those same attributes on 
behalf of the students ID, whitout involving stiudent's login and/or 
intervention.

is there a way in the shibboleth IDP to allow as a webservice, the 
request of attributes without using the SSO part of the process ?
the 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPresolvertestshell 
does that, is it possible to invoque that kind of request from a web 
application ?

in an IDP metadata I do see a SAOP binding directed to AttributeQuery

<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" 
Location="https://IDP.exemple.org:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>

Is that the Service to request ? how ?

Thanks .