Franchise access being authenticated by our Shibboleth IdP

[Keith Carr]

On 22/02/12, Peter Schober  <peter.schober at univie.ac.at> wrote:
> * Keith Carr <kecarr at sgul.ac.uk> [2012-02-22 19:19]:
> > It has come to pass that our institution has franchised courses to
> > another institution. We shall call this "franchise-b" for reference
> > and ourselves "franchise_a". In this we are also running some of the
> > back-end services for franchise_b including ldap and shibboleth IdP
> > authentication for it's users.
> [...]
> > At the moment I am imagining using a MySQL database (called say
> > "Franchises") to hold a list of resources and whether it is licensed
> > for that franchise something like this:
> > 
> > +----------+-------------+-------------+
> > | resource | franchise_a | franchise_b |
> > +----------+-------------+-------------+
> > | ent_1    | TRUE        | TRUE        |
> > | ent_2    | TRUE        | FALSE       |
> > +----------+-------------+-------------+
> 
> If you store users from franchise_a and franchise_b in seperate
> notes/leaves of your LDAP DIT (you said you were also providing LDAP
> services for those users) you could save the MySQL daemon and SQL
> query and RDBMS data connector and deduce the franchise (and from that
> the licensed resource, e.g. in a mapped attribute definition) solely
> from the LDAP entry of a given person.
> -peter
> 
Alas Peter, I don't think that would be case:
Two different users in two separate notes/leaves of LDAP would only tell you to which group of users the user belonged.
Since those two users (in separate notes/leaves) may or may not have access to a particular resource (SP) I would have to write JavaScript to assertain whether the notes/leaves had access to a resource. Multiply this by ten, or one hundred resources (SP's) and the JavaScript starts to become very hard to maintain due to it's size.
Unless I'm missing something?
- Keith

> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120223/9392872e/attachment.html