Burden of Authorization

[David Gersic]

If the SP owner doesn't care about authorization to the point of actually doing it, then as the IdP owner, why do _I_ care about authorization any more than they do? If the SP owner is silly enough to accept the idea that any authenticated user is authorized to use their service,then I see no reason to do anything beyond basic authentication and calling it good enough.

________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, December 18, 2014 3:06 PM
To: Shib Users
Subject: Re: Burden of Authorization

On 12/18/14, 8:41 PM, "federator" <wpadmin at identiainc.com> wrote:

>Imagine that if you have IdP to handle authorization, then every user
>request will have to be intercepted by the IdP for making authorization
>decisions.

No, that's not what people mean by it. Performing authorization at the IdP
generally means blocking SSO for unprovisioned or unauthorized accounts.
That's what the vast majority of cloud services require because
authorization doesn't matter to them, the resources aren't theirs to
protect.

>I haven't seen any good implementation or even good use cases of using
>centralized authorization.  Maybe you could ask your vendors for any good
>use cases.   If not, maybe it's time to switch vendors...

You could switch ten times, and 9 of them would demand that you relieve
them of all error handling responsibility.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net