Franchise access being authenticated by our Shibboleth IdP

[Cantor, Scott]

> Ah, ok cool. What happens if they have multiple entitlements (one for each
> SP they are entitled to)? How does the simple attribute model these?

They're all present. The filter engine can be used to limit release to just the ones that apply to a service. Changing the filter is a simple operation that can be done without significant effort or worrying about restarting the IdP, whereas changing the resolver really isn't.

-- Scott