Stop an authentication procedure during attributes resolving

[Cantor, Scott]

On 4/11/12 9:33 AM, "Thierry Albain" <talbain at alcyonix.com> wrote:
>
>Can we stop an authentication procedure if the IdP cannot check an
>attribute in a DataConnector in attribute-resolver file?

Not really. You could write a custom login handler, perform manual
attribute resolution, and then respond based on the results.

>In my situation, an Apache Web server authenticate users by client TLS
>protocol. Apache validates the user certificate (CRL and AC
>signature), and give the CN of the subject of the certificate to IdP
>by RemoteUser handler. IdP check CN certificate in LDAP and if it
>fails, it just returns no attribute to SP. And SP allows access to
>applications.

You can't fix the problem of people not implementing authorization by
pretending you have control over it. It's ultmately up to the SP. There
are user support reasons to do things at the IdP that it shouldn't have to
do, but there is absolutely no chance of guaranteeing that in every
possible case attributes will show up. No SP can assume that and any that
do are broken.

-- Scott