Franchise access being authenticated by our Shibboleth IdP

[Chad La Joie]

On Thu, Feb 23, 2012 at 06:11, Keith Carr <kecarr at sgul.ac.uk> wrote:
> Decide locally how you're going to store grant information for any
> random service.  I'm an LDAP kinda guy so I'd do it there.  Scott's a
> database guy so he'd do it there.  But wherever you do it, just be
> clear that what you're doing is store a grant to a particular service
> because a specific user has access to that service.  Don't try to
> infer it from some other potentially correlated data.
>
> If I understand you correctly I think it's this I'm trying to do:
> - Ascertain from LDAP which franchise to which the user belongs.
> - Then look up in the database whether the franchise to which the user
> belongs has access to the resource (SP) being requested.
> Have I understood correctly?

No.  Don't try to imply entitlement.  The user either has it, or they
don't.  So, go to the directory or database, look up entitlements.
Done.

The reason for this is that eventually (and probably sooner rather
than later) you'll start running in to exception to the fuzzy logic
you're trying to use to determine entitlement.  And as soon as you do,
you end up having to put a new set of logic in place.  And then when
the next exception comes along you have to put a new set of logic in
place.  etc.  So, if you start by treating
grants/privileges/entitlements as first level concepts and track them
as such, you're not going to run in to issues (and it'll be slightly
more efficient when actually have to look up the data).

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered