Disallow eppn/affiliation to be asserted by the wrong IdP

[Cantor, Scott]

On 10/11/12 12:05 PM, "William Spooner"
<william.spooner at eaglegenomics.com> wrote:
>
>The upshot; it's going to be too much effort to configure shibboleth to
>handle this natively at the SP end. My solution is an apache
>PerlAuthzHandler that uses the persistent-id to check that the userid is
>from the correct IdP entity based on per-IdP regexps. Using a handler
>means that the application layer remains unaware of IdP shenanigans. Bit
>of a shame, but it's a case of "better the devil you know".

The SP does that for you as well. It checks the NameQualifier and
SPNameQualifer in a persistent NameID against the asserting and relying
party names.

-- Scott