Deny user to access SP via IdP?

[David Bantz]

Perhaps you should ask this vendor how, prior to SAML, they prevented “unauthorized” users from attempting access;
if they had a login button or URL, could they make that not appear or not work for some users without knowing anything
about that prospective user?


On Thu, 12 Jun 2014, at 08:32 , Ian Rifkin <irifkin at brandeis.edu> wrote:

> Hi,
> 
> I run a Shib IdP and I get the difference between authentication and authorization, but unfortunately not every vendor I work with has this understanding.
> 
> One vendor recently stated their expectation that we would only be sending people to their application if they should have access! My understanding is that I'm doing authentication and can give the SP whatever info they need to make authorization decisions --  many SPs understand this, but apparently not all.
> 
> My question is if it's possible for the IdP to do some kind of authorization for specific SPs…
> 
> I see that I can make filters to deny attributes based on the value of another attribute like so:
> <afp:AttributeFilterPolicy>
>   <afp:PolicyRequirementRule xsi:type="basic:AttributeValueString" attributeID="someAttribute" value="someValue" />
>     <afp:AttributeRule attributeID="someOtherAttribute">
>       <afp:DenyValueRule xsi:type="basic:ANY" />
>     </afp:AttributeRule>
>     <afp:AttributeRule attributeID="someOtherOtherAttribute">
>       <afp:DenyValueRule xsi:type="basic:ANY" />
>     </afp:AttributeRule>
> …
> </afp:AttributeFilterPolicy>  
> This is close, but it's still directing the user to the SP (just not with much info about them). If I try this against my test SP or against sp.testshib.org the auth to the SP still "works". I think the SP doesn't get any real identifying info about the user, except for the IP, but it's still a successful authentication to the SP.
> 
> FYI, this matters for things like license agreements with vendors that we're paying for X number of seats or paying for a specific type of user to have access. Some vendors take the correct approach and look at an attribute like eduPersonScopedAffiliation, but alas not every vendor will do so.
> 
> Is it possible to not send anything back to the SP for users that match a PolicyRequirementRule (for a given SP / AttributeRequesterString)?
> 
> Or even better…is it possible to redirect a user to a URL of my choosing if the they match the criteria -- basically not sending them (back) to the SP unless they "should" have access to it.
> 
> I imagine this is a bit…unconventional…but I would appreciate if anyone has any insight.
> 
> Thanks,
> Ian
> 
> -- 
> Ian Rifkin
> Software Systems Manager
> Library and Technology Services (LTS)
> Brandeis University
> 
> http://go.brandeis.edu/u:irifkin
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140612/2220cc99/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140612/2220cc99/attachment.bin