Extending the IdP to release a list of all permitted users for a SP.

[Phil Lello]

Hi all,

I'm relatively new to Shibboleth, and my interest was originally sparked by
integration issues between a SP and IdP controlled by the same university.

I'm wondering if it would make sense to add an extension to the IdP that
allowed a SP to request that an IdP return attributes for all users that
the IdP wants to be able to use a given SP. I tried searching the archives,
but either my search terms were bad, or this topic hasn't come up before.

On the face of it, this seems to be desirable, since the IdP already takes
care of combining and filtering attributes, possibly from multiple sources,
and duplicating this process elsewhere is more maintenance.

The generic use case is to allow application permissions on a SP to be set
up before an IdP user interacts with it for the first time. The more
specific use case is for a VLE/LMS (SP) to be able to query the IdP for
active enrolments in modules, so that a course administrator can see a list
of enrolled students, even if they haven't logged in.

Has this been discussed before? Is it desirable, or are there good reasons
why this shouldn't be an option for a relying party?

Best wishes,

Phil Lello
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150411/8b7ea2f6/attachment.html