Authorization decision query

[Cantor, Scott]

On 10/2/13 8:02 PM, "Michael A Grady" <mgrady at unicon.net> wrote:

>I've come across a use case which appears like it will require support
>for the SAML authorization decision query/response. I'd forgotten (if I
>had even known before) that that was defined in SAML.

It was essentially ignored in 2.0 and left as a legacy feature. XACML was
intended to replace that functionality.

>I note that there is underlying support for this in OpenSAML, and it
>looks like the Globus project might have written code in the past to
>support this. Any recommendations on open source implementations
>supporting that query?

If you mean servers, I have no idea. All of the basic transport and
security code in both OpenSAML versions can handle them. If there was a
use case, it would be largely trivial to build an AttributeResolver plugin
to the SP to do a decision query and express the result as an attribute.

-- Scott