Franchise access being authenticated by our Shibboleth IdP

[Cantor, Scott]

On 2/22/12 8:40 PM, "Chad La Joie" <lajoie at itumi.biz> wrote:

>Decide locally how you're going to store grant information for any
>random service.  I'm an LDAP kinda guy so I'd do it there.  Scott's a
>database guy so he'd do it there.  But wherever you do it, just be
>clear that what you're doing is store a grant to a particular service
>because a specific user has access to that service.  Don't try to
>infer it from some other potentially correlated data.

I didn't see his proposed approach as anything other than this. But the
issue for me is what the attributes are on the wire, because that's what
determines whether you're re-doing your resolver every time you federate
with an SP. My goal is not to do that. Really, it's more like a
requirement, given the risks.

>Once you get that, then you can talk with each SP to see what
>attribute they want you to send and what value they want.  You can use
>the IdP to lookup the data, name it whatever the SP wants, munge the
>value to whatever they want, and send int.

You certainly can do it that way. But I don't want to, and more
importantly in the context of this thread, I don't like to see practices
from others take root that will end up forcing me to do what I don't want
to do when it's my turn. This is all Mutually Assured Destruction at the
end of the day.

-- Scott