Shibboleth Developers

["Tom Scavo" <>]

On Mon, Oct 27, 2008 at 1:00 PM, Scott Cantor 
<>
 wrote:
>
>> 1/ As part of AuthnRequest you can't specify the attributes required.
>> Attribute Query/Response is the thing to use for this. [Please correct me
> if
>> I misunderstood the spec]
>
> That's not really true. You can put them in the SP's metadata, which is
> similar to how Cardspace works. The fact that people don't use that feature
> is the biggest reason I'm skeptical of an extension to list them in an
> AuthnRequest. The number of cases where that would be required and using
> metadata wouldn't work is fairly small, I think.

Well, metadata is largely unsupported outside of higher ed and
relatively inflexible anyway.  The latter, in particular, makes
metadata unsuitable for specifying attribute requirements.  Moreover,
when you consider other use cases beyond Web Browser SSO (e.g., the
case in which the presenter is the SAML requester), metadata doesn't
even exist.  So all things considered, it's a good idea to support
attributes in AuthnRequest.  This was simply an oversight in the SAML
spec (which was necessarily focused on Web Browser SSO).

Tom