An open discussion list for topics related to the eduGAIN interfederation service.

[Ian Young <ian AT iay.org.uk>]

On 27 Mar 2014, at 10:13, Niels van Dijk <niels.vandijk AT surfnet.nl> wrote:

> eduGAIN policy states:
> (http://www.geant.net/service/eduGAIN/resources/Documents/eduGAIN_metadata_profile_v3.doc)
> 
> "NOTE on <md:RequestedAttribute>: Whenever a Service Provider needs
> attributes it should list them as <md:RequestedAttribute> in the
> <md:AttributeConsumingService> of its <md:SPSSODescriptor> element to
> increase the chance that Identity Providers really release them."
> 
> Based on the above I assume that I can connect to this SP not releasing
> any attributes.

I doubt that. It's more likely that the entity comes from a federation which 
hasn't traditionally required this metadata to be provided by SPs. The UKf is 
in that category, for example, but I think quite a few others are as well. We 
do ask people opting SPs in to eduGAIN to provide this, but it is a bit of an 
uphill struggle in some cases and it is optional.

> However, the note is a bit ambiguous:
> - It does not state "MUST list them"
> - It spells "should" and not "SHOULD" as defined per RFC2119

Right, this is optional metadata, both in the base SAML 2.0 Metadata 
specification and in the eduGAIN profile. I suspect that we'd want to use the 
normative SHOULD rather than the informal "should" in the next revision of 
that document, but it doesn't change the meaning: you cannot rely on that 
metadata being present, and if it is not present then you'll need to acquire 
information about expected attributes for the SP through another channel, or 
just release whatever you feel is the minimum bundle you can release to 
anyone.

You might try asking the federation operator in question whether that 
metadata can be added for the SP, if you have an implementation that makes 
use of it.

> What is expected behaviour from the IdP?

There's no mandated behaviour in SAML as far as I remember; it's informative 
only.

        -- Ian

Attachment: smime.p7s
Description: S/MIME cryptographic signature