Configuring Shibboleth SP 2.6 to send attribute queries

[Misagh Moayyed]

> The IdP is broken, it's supplying an invalid AttributeStatement element (minOccurs on Attribute is 1). That's likely circumventing the usual outcome.

Excellent, thank you. The minOccurs bit set me free. A few related follow-up questions, if I may:

The SP fails to validate the signature of the final response produced in response to the attribute query. What are the "signing rules"? A few references in the spec seem to only indicate that the "the responder must identify itself to the requester by signing the message" but the noob in me fails to understand how. Is the signing of the response to an attribute query any different than the usual signing of a response, in response to an authn-request? (because the initial response validates just fine)

The Shib SP logs indicate that there is a key mismatch found first upon validation of the response and the validation logic then starts to use the certificate within the signature and begins to compare "something" (logs not exactly clear here) against the CN and the SubAltName of that cert. Is this bit here the key difference where metadata must be tweaked to indicate keynames of some sort to allow for that match? 

-- Misagh