Franchise access being authenticated by our Shibboleth IdP

[Keith Carr]

On 23/02/12, Chad La Joie  <lajoie at itumi.biz> wrote:
> On Thu, Feb 23, 2012 at 06:11, Keith Carr <kecarr at sgul.ac.uk> wrote:
> > Decide locally how you're going to store grant information for any
> > random service.  I'm an LDAP kinda guy so I'd do it there.  Scott's a
> > database guy so he'd do it there.  But wherever you do it, just be
> > clear that what you're doing is store a grant to a particular service
> > because a specific user has access to that service.  Don't try to
> > infer it from some other potentially correlated data.
> >
> > If I understand you correctly I think it's this I'm trying to do:
> > - Ascertain from LDAP which franchise to which the user belongs.
> > - Then look up in the database whether the franchise to which the user
> > belongs has access to the resource (SP) being requested.
> > Have I understood correctly?
> 
> No.  Don't try to imply entitlement.  The user either has it, or they
> don't.  So, go to the directory or database, look up entitlements.
> Done.
> 
I'm not sure I understand what you mean? What do you mean by look up entitlements?

> 
> 
> The reason for this is that eventually (and probably sooner rather
> than later) you'll start running in to exception to the fuzzy logic
> you're trying to use to determine entitlement.
> 
Surely this isn't fuzzy logic?
-Look up the user's group
-Determine if the group has access to the resource requested
if (the group has access to the resource) {
  give permitted value to the user's eduPersonAffiliation attribute
} else {
  do not give a value to the user's eduPersonAffiliation attribute
}


> And as soon as you do,
> you end up having to put a new set of logic in place.  And then when
> the next exception comes along you have to put a new set of logic in
> place.  etc.  So, if you start by treating
> grants/privileges/entitlements as first level concepts and track them
> as such, you're not going to run in to issues (and it'll be slightly
> more efficient when actually have to look up the data).
> 
Can you explain (in a simple way) how you would achieve what I am trying to accomplish?

-Keith

> 
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120223/7ce14323/attachment.html