Authorization using shibboleth sso

[Peter Schober]

Sat forgotten in my drafts folder, not sure it will help clear up things:

* Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-01 12:49]:
> Yes Authorization should be done at SP side. In my case Authorization is
> permissions of the logged in user, that's why i want to get the permissions
> of the user when login.jsp(username,pwd) is submitting to our server.So
> that i can use those permissions to do authorization.

Again, any data you would like to send to the SP the IDP would need to
gather first (attribute resolver), from an authoritative system.
Or genertate it on the fly within the IDP, based on other data
resolved from an authoritative system, which amounts to the same thing.

So first the subject authenticates (wherever, however), once you have a
principal established in the IDP you can use that to look up more data
about the subject via whatever interface the IDP and the data source
share (or can be made to share).
-peter