Not-so-hypothetically

[Keith Hazelton]

Bamboo users may access back-end text repositories some of whose access
policies allow access by anyone with library privileges at their IdP
institution. The ePEntitlement urn:mace:dir:entitlement:common-lib-terms
would be ideal, but for three wrinkles:

1) The user's SAML session is with a portal-like mid-tier, and there are
established trust relationships between the mid-tier hosts and the
back-end services. However, in general, attribute assertions from an IdP to a particular
SP should not be passed on to arbitrary back-end apps by that
SP.

2) SAML ECP with the mid-tier acting as a SAML Enhanced Client would
seem a good fit but practically speaking few of the IdPs involved
support ECP endpoints.

3) Relatively few IdPs in the wild assert the ...common-lib-terms
entitlement.  But most do carry & appropriately release
ePScopedAffiliation.

So, not-so-hypothetical question: What should the portal do?  What security 
objections would be raised against sending the back-end repository
manager a "library patron" flag derived from IdP-asserted affiliations
of faculty, staff, student &/or member?