Burden of Authorization

[Nate Klingenstein]

There’s a long and sordid history of differential interpretations, policy languages, and attribute buckets.  Ultimately, it’s up to the provider of the service to enforce rules, but when the rule is “authentication is authorization as far as we’re concerned”, the identity provider may find itself enforcing authorization decisions as part of the authentication flow.

We would still consider making the authorization decision at the SP to be the “correct” approach.  Accommodating either will be, for better or worse, more easily done in IdPv3.

On Dec 18, 2014, at 12:08 PM, Alex Olson <ako at byu.edu<mailto:ako at byu.edu>> wrote:

In Shibboleth/SAML protocol in general, who’s burden is it to determine whether or not principal X should be able to access some service, the IdP’s or the SP’s?

I’d be inclined to think that the IdP is simply the releaser of attributes and the SP has the burden to use those attributes to determine whether or not the principal should be allowed access, but now we are being asked by a vendor to have our IdP bear the burden of authorization. What do you think? Should I push back? Is it even possible to have the IdP bear the burden of authorization?


--
Alex K. Olson
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141218/27031619/attachment-0001.html