Question on Login Handlers

[Tom Scavo]

On Thu, Aug 22, 2013 at 8:08 PM, David Langenberg <davel at uchicago.edu> wrote:
>
> As I point out to my SPs.  The IdP does NOT do
> Authorization.  In fact, it totally sucks at that and attempts to shoehorn
> an AuthZ decision into the IdP always winds up with messy results.  What it
> is good at though is sending attributes to the SP which is far better at
> making the decision to AuthZ the user.

Let me take that one step further. The IdP authenticates the user and
sends identity attributes to the SP so that the SP can positively
identify the user (and that is all). Then the SP calls out to an
authorization server (Attribute Authority, Policy Decision Point, or
whatever you want to call it) for sufficient information to make an
authz decision. The authorization server is completely separate from
the IdP, thereby giving complete separation of concerns.

The Shib SP supports this model by its ability to query an AA distinct
from the IdP. Yes, a back-channel query has drawbacks compared to
pushing everything on the front channel (history bears this out) but
the possibility of completely isolating authz is compelling. In one
use case I've looked at, this even solves the de-provisioning problem.

Tom