Shibboleth Developers

[Tom Scavo <>]

We're trying to understand precisely how a Shibboleth 1.3 AA processes
attribute queries.  As I understand it now, when an AA receives an
attribute query, it does the following:

1) Checks for <saml:AttributeDesignator> elements in the query.  If
one or more such elements exist, the corresponding attributes are
supplied (subject to policy and availability).

2) If no <saml:AttributeDesignator> elements appear in the query, the
IdP consults the requester's metadata.  If one or more
<md:RequestedAttribute> elements exist in metadata, the corresponding
attributes are supplied (subject to policy and availability).

3) If no <md:RequestedAttribute> elements appear in metadata, the IdP
supplies all attributes (subject to policy and availability).

Is this correct?

Tom