Stop an authentication procedure during attributes resolving

[Thierry Albain]

Hi all

Can we stop an authentication procedure if the IdP cannot check an
attribute in a DataConnector in attribute-resolver file?

i.e.: If a user is authenticated but has no access to an application,
I would like,
·       Either, IdP stops authentication and not responds to SP
·       Or, SP blocs access to application

In my situation, an Apache Web server authenticate users by client TLS
protocol. Apache validates the user certificate (CRL and AC
signature), and give the CN of the subject of the certificate to IdP
by RemoteUser handler. IdP check CN certificate in LDAP and if it
fails, it just returns no attribute to SP. And SP allows access to
applications.

Can someone help me?

Thierry