Senior LevelAuthentication & Authorization
How does the SAML 2.0 Attribute Query Profile allow Service Providers to query Identity Providers out-of-band?
❓ Interview Prompt: Explain SAML 2.0 Attribute Query Profile, out-of-band SOAP requests, NameID matching, and user profile synchronization.
Standard SAML SSO passes attributes only during initial user redirection login. If a user's role or group membership changes mid-session, the Service Provider (SP) has stale data. The SAML 2.0 Attribute Query Profile enables out-of-band updates.
How Attribute Query Works:
1
SP generates an XML '<samlp:AttributeQuery>' containing the user's 'NameID'.
2
SP sends a direct server-to-server SOAP HTTP request to the IdP's Attribute Authority endpoint.
3
IdP verifies SP signature and returns an updated '<samlp:Response>' containing real-time user attributes.
4
Benefit: Allows SPs to fetch fresh authorization attributes without forcing the user to perform interactive SSO login redirects again!
Code Implementation Example
xml
<!-- SAML 2.0 Attribute Query SOAP Request -->
<samlp:AttributeQuery xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_q9921" IssueInstant="2026-07-27T12:00:00Z" Version="2.0">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.company.com</saml:Issuer>
<saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:NameID>user@enterprise.com</saml:NameID>
</saml:Subject>
</samlp:AttributeQuery>💡SAML 2.0 Attribute Query XML SOAP request format.
🎯 Interview Key Takeaway
The SAML Attribute Query Profile allows Service Providers to fetch real-time updated user attributes out-of-band via SOAP requests.
#SAML#Attribute Query#SOAP#Enterprise SSO#Senior
Back to all Authentication & Authorization Questions→