using Shib-Identity-Provider in XML Access Control

[Cantor, Scott]

On 8/1/13 11:13 PM, "Vladimir Mencl" <vladimir.mencl at canterbury.ac.nz>
wrote:

>Hi Scott,
>
>Thanks a lot - I got it working this way.
>
>Just a questions: what is a good way of changing the content setting
>exportStdVars to false _globally_ ?

Probably sticking it in the RequestMap element itself. Apache doesn't have
a way of attaching a setting that way, so that's one thing the RequestMap
can do that it can't, and since the goal isn't to limit the setting to any
specific request, it's certainly safe.

>PS: Why do you discourage doing access control by IdP entityId?

Because that's meaningless unless you control the IdP, and a bad idea even
then. No IdP will commit to authenticating only users you think are
acceptable. You should assume any IdP will issue an account to anyone for
any reason.

-- Scott