OpenSAML user discussion

["Mike Ferraro" <>]

Hi,

I couldn't find documentation about this on the Shibboleth site, so
hopefully someone that has implemented this can shed some light for me.  I
apologize if this is the wrong list to send this to.

I'm curious about how responses are constructed in these AttributeQuery
request use cases:

A. An attribute query is made and some attributes are requested that do not
exist within the attribute authority.
B. An attribute query is made and attributes are requested that exist within
the attribute authority, but some of those attribute values are null.
C. An attribute query is made and attributes are requested that exist within
the attribute authority, but some of those attribute values are empty
strings.
D. An attribute query is made with any number of attributes for a Subject
who does not exist in the attribute authority.

Given the following schema constraints:

1. AttributeStatements MUST contain at least one Attribute element.
2. Attribute elements MUST contain at least one AttributeValue element.
3. AttributeValue elements CANNOT contain null or empty strings.

These are my original thoughts for solutions:

A. An AttributeStatement is returned containing only those requested
Attributes that exist within the attribute authority.  If none of the
requested Attributes exist, then no AttributeStatement is returned.  The
Status returned is Success with some appropriate message.
B. An AttributeStatement is returned containing all recognized Attributes.
Any attributes that are null contain a "NULL" string value.  The Status
returned is Success.
C. An AttributeStatement is returned containing all recognized Attributes.
Any attributes that are empty strings contain a "NOVALUE" string value.  The
Status returned is Success.
D. No AttributeStatement is returned.  The Status returned is SUCCESS with
some appropriate message.

One question is if there is a true difference between cases A and B.
Another is if sending back actual string values for null and empty strings
could be problematic if "NULL" and "NOVALUE" are actually possible values.

Any input would be much appreciated.  Thanks!
-----
Mike Ferraro
Senior Software Engineer
CAIT : Information Technology Infrastructure Services
Harvard University