testing group membership

[Peter Schober]

* Bennett, Steve <s.bennett at lancaster.ac.uk> [2013-04-17 13:20]:
> >> I'd like to limit access to a SP to users that are members of a 
> >> specific group.
> 
> > Note that attribute policy is not how you configure authorization in the SP.
> 
> I'm not specifically aiming to handle authorization (even though it
> amounts to the same thing). I want to restrict which users'
> attributes I release: I don't want the SP to be able to have access
> to attributes of any users other than those that have been centrally
> approved to use the SP.

OK, I though the xml you posted was from the SP's attribute policy,
which has the same syntax as the IdP's attribute filter. So I thought
you were doing this at the SP.

> > Are these forward referencing memberships actually stored in the subject's
> > LDAP object or are these maintained by the memberof overlay?
> 
> They're actually maintained by the memberof overlay, but that's OK
> (I think).

The IdP wouldn't know the difference. To me that just means
restructuring your forward referencing membership attribtues in LDAP
is out of the question (since they're not part of the DIB but
dynamically maintained by the DSA).

> That's why I want to limit the release of a user's attributes by
> nested group membership, calculated at the IdP. That way, I don't
> have to care about the capabilities of an SP, and I know that the
> administrator of the SP only has access to information on the users
> that use the SP.

I probably don't understand what you're saying but anyway:
Two different issues. First you'd have to pull all group memberships
from LDAP, recursively fetching groups, avoiding loops, etc.
The only thing the IdP offers here is a Script type attribute
definition, I suppose.
The other, unrelated thing is creating filter rules that only release
relevant groups to the relevant SPs.
-peter