Configuring Shibboleth SP 2.6 to send attribute queries

[Misagh Moayyed]

> It seems like in order for the attribute query to be sent by the DP, the SOAP client/curl must first authenticate itself to the responder; The SP grabs the certificate presented by the attribute-service endpoint and compares that with what is found inside AttributeAuthorityDescriptor, processed, munched and all. If a match is found, it can proceed to actually send the query. Fine. Then, as you note on the return trip it compares the signature in the payload with essentially the same key found in AttributeAuthorityDescriptor, etc. 

Quick update: I was able to sort of confirm the above story by making sure AttributeAuthorityDescriptor lists all relevant KeyDescriptors. (One used by signing, and one used for the endpoint). With that change, all works as expected.

--Misagh