Super-dumb question about IdP + AuthZ

[Cantor, Scott]

> How would the IdP ever do authz ? By (a) some new component/plugin/API
> or (b) by equating attributes with authorization ?

Depends what you mean by authz. Usually people mean having it stop a login to block access to a service based on the state of the system, so modulo some work on making sure we have a clear story on what the context tree should be set to to make sure nothing can get issued, that's just there now with intercepts.

If you mean more PDP type stuff like XACML, we haven't ever built that functionality, it would be just a different application use case.

Of course, the IdP internally has authz problems, like access to the admin functions. I did something pretty half-assed just to make sure we could do basic IP policies but make them reloadable, and the intent later was to get that more generalized.

-- Scott