Limiting admin identities to selected SPs

[Douglas E. Engert]

Thanks.


On 6/3/2013 4:40 PM, Cantor, Scott wrote:
>> Is there a way in the IDP-2.3.8 using the attribute-resolver and/or attribute-filter
>> to return the StatusCode for the response to an Assertion for selected valid
>> users to something other then:
>>     urn:oasis:names:tc:SAML:2.0:status:Success?
>
> No, only by failing authentication using a login handler.
>
>> We would like to control which SPs some users can authenticate to,
>> in particular, a user who has admin rights on a cloud vendor's site
>> can only use that identity to that site.
>
> That isn't something the IdP was designed to do originally, so adding authorization of authentication is something you need a custom login handler to do. Mine does, though it doesn't actually return anything to an SP, it just tells the user they can't proceed. Few SPs can handle a SAML failure in any way that's useful (and mine doesn't do anything great to help that either).
>
> Excluding data from a Success response is a much more straightforward way to support an application's error handling then using a status code.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444