Burden of Authorization

[Cantor, Scott]

On 12/19/14, 3:12 PM, "David Gersic" <dgersic at niu.edu> wrote:

>If the SP owner doesn't care about authorization to the point of actually 
>doing it, then as the IdP owner, why do _I_ care about authorization any 
>more than they do? If the SP owner is silly enough to accept the idea 
>that any authenticated user is authorized to use their service,then I see 
>no reason to do anything beyond basic authentication and calling it good 
>enough.

The main reason you'd care is if/when the resources are your university's 
responsibility to protect, which is the common scenario in cloud services 
today. We're taking something that could be done by us on campus and 
punting it to somebody else. If it was done on campus, we'd probably think 
we had to do something about this.

The problem I see is that instead of punting the whole problem, people are 
buying services that solve half of it or less, and leaving the rest 
unsolved, or leaving the burden of solving the rest on us while they take 
any budget that existed for solving it and throw it at the vendor.

But if the resources aren't ours (e.g. the library case)? Heck yes, I 
completely agree with you.

-- Scott