Request attributes as a webservice without login/SSO

[Cantor, Scott]

> before going into those old "cookbook" , are these still the recommended
> way to request attributes wihtout login , and is it still supported in
> shib2 and idpv3 ?

We support SAML queries, both SAML 1 and SAML 2 in both the SP and IdP. That is the only way the IdP makes attributes available for external use outside of SSO right now.

> I see now the "ECP" profile
> (https://wiki.shibboleth.net/confluence/display/CONCEPT/ECP) , would you
> advise me to go into that direction instead ?

No, because that has nothing to do with your question. ECP is a non-browser SSO profile and is not a web service.

> you mean http://saml.xml.org/saml-specifications , that's quite long ...

It's about the length it needs to be. The people who complained about it being too long produced a fascinatingly large body of long IETF RFCs and supplemental non-standards to replace it. Guess it's not as easy as they thought.

> can you just point me to one of "core", "profile" or "binding" !?

Core defines the basic query protocol messages and is the bulk of understanding SAML, bindings defines the SOAP binding (the wrapper), and profiles is mostly just a minimal marriage of the two, so of the three not all that important for understanding queries.

-- Scott