Stopping users for insufficient attributes at the IdP in v3

[Nate Klingenstein]

I think that implementation approach will be reasonable for almost all deployers since they can write arbitrary policies easily in script in the resolver, though we may want to expressly document how to do this in a short solo Wiki article.

Thanks for the response.

On Jun 5, 2014, at 7:43 AM, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
 wrote:

When I experimented with the idea, I found that the cleanest way was to
define an attribute in the resolver that essentially expressed the policy,
and have the handler check that one attribute. That moves the policy mess
into attributes, and allows pre-existing authorization services at a
campus to be the source.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140605/52654aca/attachment.html