Deny user to access SP via IdP?

[Douglas E Engert]

On 6/12/2014 11:32 AM, Ian Rifkin wrote:
> Hi,
>
> I run a Shib IdP and I get the difference between authentication and authorization, but unfortunately not every vendor I work with has this understanding.
>
> One vendor recently stated their expectation that we would only be sending people to their application if they /should/ have access! My understanding is that I'm doing authentication and can give the
> SP whatever info they need to make authorization decisions --  many SPs understand this, but apparently not all.
>
> My question is if it's possible for the IdP to do some kind of authorization for specific SPs…
>
> I see that I can make filters to deny attributes based on the value of another attribute like so:
>
>         <afp:AttributeFilterPolicy>
>            <afp:PolicyRequirementRule xsi:type="basic:AttributeValueString" attributeID="someAttribute" value="someValue" />
>              <afp:AttributeRule attributeID="someOtherAttribute">
>                <afp:DenyValueRule xsi:type="basic:ANY" />
>              </afp:AttributeRule>
>              <afp:AttributeRule attributeID="someOtherOtherAttribute">
>                <afp:DenyValueRule xsi:type="basic:ANY" />
>              </afp:AttributeRule>
>         …
>         </afp:AttributeFilterPolicy>
>
> This is close, but it's still directing the user to the SP (just not with much info about them). If I try this against my test SP or against sp.testshib.org <http://sp.testshib.org> the auth to the SP
> still "works". I think the SP doesn't get any real identifying info about the user, except for the IP, but it's still a successful authentication to the SP.
>
> FYI, this matters for things like license agreements with vendors that we're paying for X number of seats or paying for a specific type of user to have access. Some vendors take the correct approach
> and look at an attribute like eduPersonScopedAffiliation, but alas not every vendor will do so.
>
> Is it possible to not send /anything/ back to the SP for users that match a PolicyRequirementRule (for a given SP / AttributeRequesterString)?
>
> Or even better…is it possible to redirect a user to a URL of my choosing if the they match the criteria -- basically not sending them (back) to the SP unless they "should" have access to it.
>
> I imagine this is a bit…unconventional…but I would appreciate if anyone has any insight.

We had a similar situation:

http://shibboleth.1660669.n2.nabble.com/Restricting-Authentication-to-a-subset-of-Users-td6375260.html

This was complicated by the attribute-resolution and filtering have no way to set
a SAML Status such as one of these:
urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
urn:oasis:names:tc:SAML:2.0:status:RequestDenied

Even if the IDP could, the SP might not handle it it very well.

So we send no attributes so the SP could not identify a user.

(Only a small set of our users fall into this situation and learn quickly not to do it again.)


>
> Thanks,
> Ian
>
> --
> Ian Rifkin
> Software Systems Manager
> Library and Technology Services (LTS)
> Brandeis University
>
> http://go.brandeis.edu/u:irifkin
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>