The AA then creates the attribute response message, sending back the attributes and a validity period. The SHAR receives the attribute response, does checks on the signature etc, and obtains the user's attributes. The SHAR can either make another attribute request or use the user handle to find attributes that it has cached. We have another message flow that also solves the indexical problem but doesn't yield a user handle that could be used for new attribute requests. I'll send this along later.
Comments welcome of course.
I apologize for the lack of pictures.