Limiting admin identities to selected SPs

[Cantor, Scott]

> Is there a way in the IDP-2.3.8 using the attribute-resolver and/or attribute-filter
> to return the StatusCode for the response to an Assertion for selected valid
> users to something other then:
>    urn:oasis:names:tc:SAML:2.0:status:Success?

No, only by failing authentication using a login handler.

> We would like to control which SPs some users can authenticate to,
> in particular, a user who has admin rights on a cloud vendor's site
> can only use that identity to that site.

That isn't something the IdP was designed to do originally, so adding authorization of authentication is something you need a custom login handler to do. Mine does, though it doesn't actually return anything to an SP, it just tells the user they can't proceed. Few SPs can handle a SAML failure in any way that's useful (and mine doesn't do anything great to help that either).

Excluding data from a Success response is a much more straightforward way to support an application's error handling then using a status code.

-- Scott