Redirecting to protected resourse based on user Credential

[Peter Schober]

* Mukesh Nair (UST, IND) <Mukesh.Nair at ust-global.com> [2012-05-12 06:20]:
> Suppose there are two protected resource A and B.
> 
> User is trying to access Protected resource C,Once User is
> authorized(username/Password validated) depending on type of
> user(student/teacher) can we authorize
> 
> And redirect the user to access A or B alone?

The SP software won't generate redirects to arbitrary resources itself
after succesful authorization as that's rather pointless in most cases
and can trivially be done with protceting a 1-2 line CGI script that
generates a Location HTTP header on resource C (e.g. depending on
affiliation).

Keep in mind that resource A and B would then also need to implement
access control rules. If authorization (e.g. checking the affiliation)
only happended at resource C one could easily set a bookmark after
ending up at resource A (or B) and access resource A (or B) directly,
skipping authorization at C.

Unless of course that redirect from C to A (or B) contains some
security provisions itself, effectively a different SSO protocol.
Or resource C proxies requests for resource A (or B), instead of
redirecting there.

Cf. https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany
-peter