Stopping users for insufficient attributes at the IdP in v3

[David Chadwick]

On 05/06/2014 04:11, Nate Klingenstein wrote:
> All,
> 
> Many commercial SAML products will stop the user at the IdP if they
> can precalculate that the user would be denied access at the SP due
> to insufficient attributes or a missing entitlement, but in IdPv2.x,
> this required writing a custom login handler to accomplish.

This is the symptom of a misguided IdP mindset. Firstly the IdP does not
know which other IdPs the user has a relationship with, and therefore
may be able to supplement the first IdP's insufficient set of attributes
with ones from other IdPs (attribute aggregation) in order to
successfully access the SP. Secondly, the IdP wrongly seems to think it
controls the user's identity and who should be able to see it. A more
user centric view would regard the user as being in control of his
identity attributes and be the deciding force in who should see what.
e.g. I can show you my Visa card/Passport/Driving license etc. without
requiring the permission of the issuing IdP.

> 
> I've written treatises on why handling this condition at the SP is
> better and I'll keep fighting for it, but I'm not winning every
> battle.

Keep it up. You are on the right path.

> 
> Will it be possible for a deployer of IdPv3 to direct a user to an
> "insufficient attributes" error page using configuration alone if
> they choose to do so?  Should it be?

If you could enable the SAML request to more flexibly request a set of
user attributes from the IdP this would help. Asking for "all" or
pointing to a mandatory set in metadata is not flexible enough. Ideally
the SP should be able to indicate mandatory and optional attributes, and
alternatives.

regards

David
> 
> Thanks, Nate. -- To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>