IDP filtering SPs?

[Nate Klingenstein]

Bryan,

I swear I just some recent posts regarding filtering access to Sps at the Idp. Ie the SP thinks that authentication equals authorization so it is incumbent on the Idp to deny access.

You're probably thinking about the thread from my recent post to the dev@ list.  June 4 MDT, "Stopping users for insufficient attributes at the IdP in v3".

In our case we a talking Box. We only want current staff/students to get accounts via Box "auto-provisoning". Apparently Box can't/won't use eduPerson affiliation to make the decision.

Anyway we need to reject logins where the user is not staff/affiliate. Does that make sense?

Looking for guidance.

I think the responses in that thread will guide you towards today's options, tomorrow's options, and a conversation to continue with SP's.  A more precise question will help if you are left wondering anything.

Hope this helps,
Nate.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140619/7d60fdd6/attachment.html