Redirect to custom URL when AttributeFilterPolicy in IdP does not met

[Cantor, Scott]

On 1/23/14, 7:07 PM, "Supakit Kiatrungrit" <supakitk at sfsu.edu> wrote:
>
>Is there a way for Shibboleth IdP to redirect user to certain URL if
>logged in user doesn't meet Policy Requirement Rule  (eg. user does not
>have some required attributes)? Can we control this on Shibboleth IdP, or
>it can only be done in Shibboleth SP.

Firstly, attribute filter policies are about attribute filtering, not
about authorization, so you are looking in the wrong spot.

Secondly, the IdP can only do this if you write a custom login handler and
do your own attribute resolving and evaluation of the data.

You should avoid doing this. The IdP is an authentication service, it's
not the proper role of it to make final authorization decisions.

-- Scott