Shibboleth Developers

["Scott Cantor" <>]

> > It's ignored in SAML 2.0 for this use case. Attribute queries by
> > reference are not allowed except during SSO.
> 
> Can you explain that last sentence to me?

There's an attribute in the AuthnRequest element called
AttributeConsumingServiceIndex. It's a shorthand way of pulling in a set of
attributes by reference to create an implicit query during SSO. The message
would be too big otherwise.

There is no such facility in the AttributeQuery element because there is no
space limitation and queries are like SQL. You tell the database what you
want and it gives it to you (or not). Or you say "select *" and you get
everything that would apply to that context.

The purpose behind "query metadata" that includes attributes is not to
optimize queries but to provision ARPs. The mystical ARP GUI, in other
words.

-- Scott