Deny user to access SP via IdP?

[Mark K. Miller]

On Thu, 12 Jun 2014, Tom Scavo wrote:

> On Thu, Jun 12, 2014 at 12:32 PM, Ian Rifkin <irifkin at brandeis.edu> wrote:
>>
>> My question is if it's possible for the IdP to do some kind of authorization
>> for specific SPs?
>
> Yes, for some use cases, this is the way to go. In the Library use
> case, for example, the campus is in the best position to determine if
> and when a user should have access to a library resource (according to
> whatever contract is in place), so it's not unreasonable for the IdP
> to send an eduPersonEntitlement that indicates whether the user should
> have access.

Good example, Tom.  The entitlement may be present to allow access, or the 
entitlement may be missing to imply no access.

However, I'm wondering if we translate this to Ian's experience with the 
vendor, I'd guess his vendor is trying to say "only send the users that 
have the entitlement."  Specifically, the vendor doesn't want to make any 
decision.

> Tom

Max