Franchise access being authenticated by our Shibboleth IdP

[Keith Carr]

On 23/02/12, Peter Schober  <peter.schober at univie.ac.at> wrote:
> * Keith Carr <kecarr at sgul.ac.uk> [2012-02-23 13:25]:
> > > No.  Don't try to imply entitlement.  The user either has it, or they
> > > don't.  So, go to the directory or database, look up entitlements.
> > > Done.
> > > 
> > I'm not sure I understand what you mean? What do you mean by look up
> > entitlements?
> 
> My interpretation would be to take that literally and lookup a users
> entitlements (e.g. common-lib-terms) from a directory service or an
> RDBMS and use those "as is" in the IdP. (Assuming access is granted to
> the SP based on an entitlement).
> 
Ahhh, I understand. I do store the user's entitlement in LDAP (e.g; "student" or "staff") and this is supplied to the resource. I guess the answer would be to have a new entitlement given to the franchised users (e.g. "franchise") and to those resources that they have access, add it to the list of entitlements they accept?
-Keith

> 
> 
> That's pretty close to what I said before when if I'd be creating
> such a system from scratch, to base it on the individual user(s).
> It'll also avoid implementing logic (and the inevitable exceptions) in
> the IdP, as all the logic (who gets access to what) needs to be
> implemented when storing those values somewhere in LDAP/an
> RDBMS. Granted it still has to happen somewhere, but then it'd be OOB
> and not involving the IDP at all. (Consider this "flattening" the
> affiliations, entitlements and "franchise" groups to a list of users
> and their services. Might also be useful for internally provided
> services).
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120223/50e6ef26/attachment.html