login failed for scitation.aip.org in IDP3

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2016-03-14 15:03]:
> I hadn't dealt with that SP myself yet and none of the 5 academic
> federations that have registered this SP bothered to include
> RequestedAttribute elements:
> https://met.refeds.org/met/entity/https%253A%252F%252Fscitation.aip.org%252Fshibboleth/

My bad, DFN-AAI in fact does provide the needed into, and as suspected
it's only eduPersonEntitlement (assuming the common-lib-terms value)
and/or eduPersonScopedAffiliation (I'm guessing only as fall-back or
to allow institutions to chose the attribute in a self-service web UI,
or some such).

> If that's mostly non-PII data (I'd expect to find an entitlement --
> likely with the common-lib-terms value as the only attribute released)
> you should probably just push that attribute over the browser also for
> SAML1 (includeAttributeStatement was the setting in v2, check the docs
> for v3), and forget about the back channel.

So at least for that SP pushing non-PII attribute values over the
browser unencrypted seems totally acceptable.
-peter