Franchise access being authenticated by our Shibboleth IdP

[Peter Schober]

* Keith Carr <kecarr at sgul.ac.uk> [2012-02-23 02:28]:
> Two different users in two separate notes/leaves of LDAP would only
> tell you to which group of users the user belonged.

Based on what you write the granularity is "franchise", not individual
users. So identifying the franchise based on "data"/"metadata" of the
subject could replace the database tables, IMO.

> Since those two users (in separate notes/leaves) may or may not have
> access to a particular resource (SP) I would have to write
> JavaScript to assertain whether the notes/leaves had access to a
> resource. Multiply this by ten, or one hundred resources (SP's) and
> the JavaScript starts to become very hard to maintain due to it's
> size.

That's why I mentioned the mapped attribute defintion. I would
probably assign an attribute identifying the franchise in the script,
and in a seperate attribute create all the necessary entitlements
based on that franchise attribute. That's not expected to grow
unweildly soon, as for each "SourceValue" (the franchise) you'll have
several ReturnValues (e.g. entitlements or whatever), one per line.

Anyway I just though I'll mention the possibility of reusing existing
information instead of setting up yet another repository of data that
needs to be managed somehow (sync'ed from a SOR or providing
management interfaces for the people managing contracts, etc.).
If I'd create such a system for grants/permissions I'd certainly
want to design it to be granular to each netid/subject, and also
factor group memberships and/or other organizational data into its
(calculated) output. Just my 2¢.
-peter