Deny user to access SP via IdP?

[Tom Scavo]

On Thu, Jun 12, 2014 at 12:32 PM, Ian Rifkin <irifkin at brandeis.edu> wrote:
>
> My question is if it's possible for the IdP to do some kind of authorization
> for specific SPs…

Yes, for some use cases, this is the way to go. In the Library use
case, for example, the campus is in the best position to determine if
and when a user should have access to a library resource (according to
whatever contract is in place), so it's not unreasonable for the IdP
to send an eduPersonEntitlement that indicates whether the user should
have access.

Tom