Super-dumb question about IdP + AuthZ

[Mike Schwartz]

Tom,

I think the answer to your question is yes and no.

Yes, the same server that performs authn may be convenient place to 
store policies about which people, using which clients (SP's) can access 
which resources.

No, because as Scott points out, SAML and OIDC weren't designed to 
address this use case.

For exmaple, the Gluu Server implements two different OAuth2 profiles 
that enable a resource server to rely on a central authorization server: 
UMA where an RPT (resource protection token) authorizes a client to call 
a certain API, and we're are also introducing a shorter workflow that is 
more traditional OAuth2 flow for this purpose, see: 
https://ox.gluu.org/doku.php?id=uma:oauth2_access_management (which will 
be available in our next release 2.4.2)

So if your IDP is also the PDP... you're in business. This is the case 
for traditional WAM tools like CA Siteminder.

Hope that helps...

Mike

On 2016-02-16 10:21, Tom Zeller wrote:
> How would the IdP ever do authz ? By (a) some new component/plugin/API
> or (b) by equating attributes with authorization ?
> 
> Apologies for the dumb question.