Stopping users for insufficient attributes at the IdP in v3

[Cantor, Scott]

On 6/4/14, 11:11 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:
>
>Will it be possible for a deployer of IdPv3 to direct a user to an
>"insufficient attributes" error page using configuration alone if they
>choose to do so?  Should it be?

I haven't written anything, but it's possible. There's no way to do this
without defining the policy in the IdP though, and we don't have any
language to express that.

When I experimented with the idea, I found that the cleanest way was to
define an attribute in the resolver that essentially expressed the policy,
and have the handler check that one attribute. That moves the policy mess
into attributes, and allows pre-existing authorization services at a
campus to be the source.

-- Scott