testing group membership

[Bennett, Steve]

> OK, I though the xml you posted was from the SP's attribute policy,
> which has the same syntax as the IdP's attribute filter.
> So I thought you were doing this at the SP.

Ah, sorry! I hadn't realised that I was being ambiguous...!


>> That's why I want to limit the release of a user's attributes by 
>> nested group membership, calculated at the IdP. That way, I don't have 
>> to care about the capabilities of an SP, and I know that the 
>> administrator of the SP only has access to information on the users 
>> that use the SP.

> I probably don't understand what you're saying but anyway:
> Two different issues. First you'd have to pull all group memberships from LDAP,
> recursively fetching groups, avoiding loops, etc.
> The only thing the IdP offers here is a Script type attribute definition, I suppose.
> The other, unrelated thing is creating filter rules that only release relevant groups to the relevant SPs.

I think you've understood it perfectly.
I think I need to store a flat copy of my group memberships in a database. Then it's a simple lookup for the first part, and I already have the second part working.

Thanks!!

Steve.