Franchise access being authenticated by our Shibboleth IdP

[Peter Schober]

* Keith Carr <kecarr at sgul.ac.uk> [2012-02-22 19:19]:
> It has come to pass that our institution has franchised courses to
> another institution. We shall call this "franchise-b" for reference
> and ourselves "franchise_a". In this we are also running some of the
> back-end services for franchise_b including ldap and shibboleth IdP
> authentication for it's users.
[...]
> At the moment I am imagining using a MySQL database (called say
> "Franchises") to hold a list of resources and whether it is licensed
> for that franchise something like this:
> 
> +----------+-------------+-------------+
> | resource | franchise_a | franchise_b |
> +----------+-------------+-------------+
> | ent_1    | TRUE        | TRUE        |
> | ent_2    | TRUE        | FALSE       |
> +----------+-------------+-------------+

If you store users from franchise_a and franchise_b in seperate
notes/leaves of your LDAP DIT (you said you were also providing LDAP
services for those users) you could save the MySQL daemon and SQL
query and RDBMS data connector and deduce the franchise (and from that
the licensed resource, e.g. in a mapped attribute definition) solely
from the LDAP entry of a given person.
-peter