Franchise access being authenticated by our Shibboleth IdP

[Chad La Joie]

Well, there isn't any "must" or "have to" here.  What Scott and I and
now Keith H. are trying to do is to head off a mistake we've seen over
and over that causes problems.

So, let me be as blunt as possible.  Stop talking about franchises.
It has *nothing* to do with authorization.

Create an attribute in your LDAP called "entitlement".  Create
separate values for access to SP1 ... SPN.

When a user should have access to SP1, put the SP1 entitlement in to
the "entitlement" attribute.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered