Deny user to access SP via IdP?

[David Gersic]

>>> On 6/12/2014 at 01:15 PM, "Mark K. Miller" <max at psu.edu> wrote: 

> On Thu, 12 Jun 2014, Tom Scavo wrote:
> 
>> On Thu, Jun 12, 2014 at 12:32 PM, Ian Rifkin <irifkin at brandeis.edu> wrote:
>>>
>>> My question is if it's possible for the IdP to do some kind of authorization
>>> for specific SPs?
>>
>> Yes, for some use cases, this is the way to go. In the Library use
>> case, for example, the campus is in the best position to determine if
>> and when a user should have access to a library resource (according to
>> whatever contract is in place), so it's not unreasonable for the IdP
>> to send an eduPersonEntitlement that indicates whether the user should
>> have access.
> 
> Good example, Tom.  The entitlement may be present to allow access, or the 
> entitlement may be missing to imply no access.
> 
> However, I'm wondering if we translate this to Ian's experience with the 
> vendor, I'd guess his vendor is trying to say "only send the users that 
> have the entitlement."  Specifically, the vendor doesn't want to make any 
> decision.

The vendor is off-loading the decision making to the guy running the IdP. So, if the vendor doesn't care enough to do their own work ...

Decision: "All users are entitled. Hope that helps. Have a nice day."