Franchise access being authenticated by our Shibboleth IdP

[Cantor, Scott]

> A Query would be performed on the database using a data connector for the
> requesting resource and values returned for all the franchises. Each
> franchise "field" returned from the query would be put into an attribute
> (FRANA_GRANTED and FRANB_GRANTED). This would then be assessed
> along with the "shibbolethset" attribute to determine whether the user
> should be given a eduPersonAffiliation attribute value which will grant access
> to the resource.

That's a fundamental problem. Affiliation is not based on whether you have access to a resource, it's a fact of the identity involved independent of any resource. It's a very bad idea to conflate that.

-- Scott