IdP 8443 (v3.2.1)

[Tom Scavo]

On Fri, Jun 3, 2016 at 11:30 PM, Jann Malenkoff <jannmalenkoff at gmail.com> wrote:
> There is a bit of a debate going on at or university.
>
> What exactly is the following used for by the IdP?
>
> If we use SAML2 - what is the purpose of the back-channel port 8443?
>
> <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
>
> Location="https://example.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery" />

Nate already answered your question but I wanted to add this tidbit:
In 98% of cases, having a SAML2 AttributeService endpoint in published
metadata is redundant and in some cases this will actually cause
spurious errors at the SP. If an IdP routinely pushes attributes on
the front channel, there is no reason to expose a query endpoint.
Moreover, an SP that does not receive attributes on the front channel
(because the IdP's attribute release policy is not cooperating), will
often make a redundant query in search of additional attributes. Not
receiving any, it will display an error message about the query, not
about the lack of attributes.

The moral to the story is: Don't expose such an endpoint in published
metadata (unless you're one of the very small percentage of IdPs that
actually needs it for some reason).

Tom