Triggering SP error page / restrict access to a list of users

[Peter Schober]

* Manuel Haim <haim at hrz.uni-marburg.de> [2011-10-27 17:43]:
> @Peter: we currently have a customized set of templates for our SPs,
> reflecting the layout of our IdP pages. These templates also contain a
> consistent menu of links and offer some help regarding Shibboleth, so
> the idea was to show the SP's "access denied" page rather than a page
> generated by the application. It also may be confusing if there are two
> "access denied" pages (one by the SP, one by the application).

I just thought customized error messages from httpd would make more
sense since these could be used by any application, whether being
shib-protected or not.
Other than that I don't think access denied messages should have
design consistenty with regard to each other, but with regard to the
application they're being a part of. But certainly overall consistency
is desirable as well, esp. when those pages contain text that is
actually helpful for users in trying to get around the 403.

> We will have a thought on calling the web server's 403 error page
> and maybe have a look at the GMT tool you mentioned.

Note that I only mentioned GMT because assumed that you wanted
"SP-enumerated" users. GMT is meant to be close to the SP, possibly
even specific to one SP instance.
But since you asked about eduPersonEntitlement ("IdP-enumerated") I
guess it's really a question of how to best delegate the work of
maintaining the list of entitled users to the resource owner. If you
have some framework in place where resource owners can manage user
rights/permissions/entitlements and this finds its way to your IdP (or
LDAP), then eduPersonEntitlements (or maybe groups) maybe be all you
need.
-peter