Shibboleth Developers

["Scott Cantor" <>]

> What should the SP do if it finds something other than an attribute
> statement in the attribute response?

It's a SHOULD NOT, but the behavior is unspecified. Adding a lot of language
to deal with all the things you could conceivably get in an XML message
that's at all extensible makes life really hard for implementers.

OTOH, the SSO profile has this ridiculous unused notion that there could be
multiple authentication statements, which is a bitch, but I don't think
that's a comparable situation.

Reading this now, though, the main thing is that all the Subject elements
should be the same and shouldn't have any SubjectConfirmation (by virtue of
the query also not having any, which should have been made explicit). That
isn't stated at all, I missed it.

-- Scott