IDP filtering SPs?

[Kevin Foote]

On Jun 19, 2014, at 2:57 PM, Bryan E. Wooten <bryan.wooten at utah.edu> wrote:

> Hi all,
> 
> I swear I just some recent posts regarding filtering access to Sps at the Idp. Ie the SP thinks that authentication equals authorization so it is incumbent on the Idp to deny access.
> 
> In our case we a talking Box. We only want current staff/students to get accounts via Box "auto-provisoning". Apparently Box can't/won't use eduPerson affiliation to make the decision.
> 
> Anyway we need to reject logins where the user is not staff/affiliate. Does that make sense?
> 
> Looking for guidance.

Send no attributes (email) if the user is not in your specific groups
We all know the caveats here. Yes this is referenced in many back posts.

--------
thanks
 kevin.foote