Franchise access being authenticated by our Shibboleth IdP

[Keith Carr]

On 23/02/12, Peter Schober  <peter.schober at univie.ac.at> wrote:
> * Keith Carr <kecarr at sgul.ac.uk> [2012-02-23 18:02]:
> > So I would need to "share" a new entitlement with our SP's in order
> > to differentiate the new franchise.
> 
> No, quite the opposite. The SP shouldn't (and usually cannot) be
> involved in any of that. All the SP should care about is that the
> principal (possibly completely unknown to the SP, if no PII attributes
> are also transmitted) has been deemed elegible for accessing this SP
> by the responsible people, in accordance with any contracts that may
> exist.
> 
Ah of course - so they only ever receive the values they expect, or not and that deems whether they are entitled to access the resource.
-Keith

> 
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120224/22c733d7/attachment.html