Configuring Shibboleth SP 2.6 to send attribute queries

[Misagh Moayyed]

> It's the same process, but the fact that it's a query means the metadata it's looking at to get the key is the AttributeAuthorityDescriptor, and it won't fall back to looking at anything else.

OK, I think I know where I went wrong, possibly with a number of faulty assumptions. Here's the story:

It seems like in order for the attribute query to be sent by the DP, the SOAP client/curl must first authenticate itself to the responder; The SP grabs the certificate presented by the attribute-service endpoint and compares that with what is found inside AttributeAuthorityDescriptor, processed, munched and all. If a match is found, it can proceed to actually send the query. Fine. Then, as you note on the return trip it compares the signature in the payload with essentially the same key found in AttributeAuthorityDescriptor, etc. 

Would you confirm that sequence is accurate? And if so, it goes without saying that my faulty assumption was to not equate the certificate presented by the endpoint with that of what's found in the metadata for the attribute query. Is that always the prerequisite, the two must always match and I just have it wrong in my set up? or is there a possibility where the cert sitting on the endpoint might be different than the signing cert? (Still fuzzy, but I am not sure the latter makes much sense). 

--Misagh