Associating SP users with specific IdPs

[Robert Lowe]

Thanks for the detailed response Scott.

> Should one require that the IdPs send scoped attributes and then
> > somehow filter out attributes that don't have the correct scope?
>
> The SP filters them automatically provided the metadata allows it to do so.
>

What exactly in the metadata would enable that?


>
> You could also rely on the  NameID construct and its qualifiers and do
> filtering based on that, along with having flexibility in how you serialize
> the NameID structure into an identifier to consume.
>

Other than scope, what qualifiers of NameID would be relevant here?


> > Or should
> > the IdPs send unscoped attributes and the SP somehow add the appropriate
> > scope before passing the attribute to the application?
>
> It does not do that, though of course an application could.
>

Couldn't a Template AttributeResolver do that, or at least produce
something that *resembles* a scoped attribute?

-- 
Best regards,

Robert Lowe
http://notability.rmlowe.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130322/882232e9/attachment.html