Checking AuthnRequest for the presence of attributes

[Cantor, Scott]

> Exactly, that's why I think I need custom checks. These restrictions are
> demanded by my federation, not by SAML specs. It's like my federation
> allows only a subset of possible SAML use scenarios.

These are not "extra checks", they are invalid checks. What you're checking for would be improper to include in the messages. If you were checking to make sure something invalid *wasn't* present, that might be defensible, but this isn't.

This isn't a subset of SAML, it's a violation of the profile (the Issuer thing in particular).

-- Scott