Status Code Response for an Invalid Principal

[Thomas Wisniewski <Thomas.Wisniewski@entrust.com>]

Title: Message

Hi, I  wanted to ask what the consensus was on the status code response value  for an  Attribute Query where the Principal  (NameID) is recognized  by the  Attribute Authority but it  is  "invalid"  at the  present time  (e.g.,  the account is suspended, deleted, locked,  etc...)   Should the  status codes returned be:

 

Requester  --  UnknownPrincipal

Requester  --  RequestDenied (seems like the  appropriate  one given the  options)

Requester --  <one of the others listed>

Requester --  <implementation specific  or  NONE>

 

Thanks, Tom.