IDP filtering SPs?

[Bryan E. Wooten]

Hi all,

I swear I just some recent posts regarding filtering access to Sps at the Idp. Ie the SP thinks that authentication equals authorization so it is incumbent on the Idp to deny access.

In our case we a talking Box. We only want current staff/students to get accounts via Box "auto-provisoning". Apparently Box can't/won't use eduPerson affiliation to make the decision.

Anyway we need to reject logins where the user is not staff/affiliate. Does that make sense?

Looking for guidance.

Thanks,

Bryan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140619/bb1b7b07/attachment.html