Exporting SP attribute policy decisions to the application

[Peter Schober]

Guillaume Rousse via users <users at shibboleth.net> [2025-11-07 11:38 CET]:
> While perfectly reasonable in most situation, this behaviour is sometimes
> counter-productive. For a conformity testing application, for instance, we'd
> like to explain the issue to the user, by providing an explicit message
> "invalid scope used (domain.tld) instead of expected one (another.tld),
> instead of "missing subject-id attribute".

Such a (meta-)service would best be implemented in your own code,
either with the Shib SP in place but not performing whatever you don't
want it to do here or completely without the Shib SP and with a SAML
SP implementation that provides you with the desired levels of control
(maybe pysaml2 or SimpleSAMLphp will expose what you need).

Extending *any* version of the Shib SP for this specific non-use-case
seems unwarranted, IMHO, in case you were suggesting that.

> This would require the SP to export some metadata information, such
> as the list of allowed scopes, for instance, using the metadata
> attribute extractor.

FWIW, getting details from a SAML 2.0 Metadata document with anything
supporting XPath should be rather easy.
E.g. to add improved error handling to an existing service I recently
wrote a short CGI script in Bash that uses curl (to refesh metadata),
xmlsec1 (for xmldsig validation, maybe use XmlSecTool instead if you
have a JVM) and xmlstarlet to pull out the required bits from the XML
for the CGI to render.
(And anything remotely resembling a usable programming language will
offer the APIs to do all that more cleanly and programmatically.)

-peter