Franchise access being authenticated by our Shibboleth IdP

[Peter Schober]

* Keith Carr <kecarr at sgul.ac.uk> [2012-02-23 13:25]:
> > No.  Don't try to imply entitlement.  The user either has it, or they
> > don't.  So, go to the directory or database, look up entitlements.
> > Done.
> > 
> I'm not sure I understand what you mean? What do you mean by look up
> entitlements?

My interpretation would be to take that literally and lookup a users
entitlements (e.g. common-lib-terms) from a directory service or an
RDBMS and use those "as is" in the IdP. (Assuming access is granted to
the SP based on an entitlement).

That's pretty close to what I said before when if I'd be creating
such a system from scratch, to base it on the individual user(s).
It'll also avoid implementing logic (and the inevitable exceptions) in
the IdP, as all the logic (who gets access to what) needs to be
implemented when storing those values somewhere in LDAP/an
RDBMS. Granted it still has to happen somewhere, but then it'd be OOB
and not involving the IDP at all. (Consider this "flattening" the
affiliations, entitlements and "franchise" groups to a list of users
and their services. Might also be useful for internally provided
services).
-peter