Extending the IdP to release a list of all permitted users for a SP.

[Dave Perry]

In answer to the specific VLE use case, I would have thought that managing enrolements is better done using a database. Our VLE (moodle) can get enrolment information from our MIS system – we havent’ set it up to be totally seamless, but the server can at least see lots of information on students, what courses they’re in, etc, and has plugins setup to make use of this for synchronising users onto courses/modules.

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Phil Lello
Sent: 11 April 2015 17:03
To: users at shibboleth.net
Subject: Extending the IdP to release a list of all permitted users for a SP.

Hi all,
I'm relatively new to Shibboleth, and my interest was originally sparked by integration issues between a SP and IdP controlled by the same university.
I'm wondering if it would make sense to add an extension to the IdP that allowed a SP to request that an IdP return attributes for all users that the IdP wants to be able to use a given SP. I tried searching the archives, but either my search terms were bad, or this topic hasn't come up before.

On the face of it, this seems to be desirable, since the IdP already takes care of combining and filtering attributes, possibly from multiple sources, and duplicating this process elsewhere is more maintenance.
The generic use case is to allow application permissions on a SP to be set up before an IdP user interacts with it for the first time. The more specific use case is for a VLE/LMS (SP) to be able to query the IdP for active enrolments in modules, so that a course administrator can see a list of enrolled students, even if they haven't logged in.
Has this been discussed before? Is it desirable, or are there good reasons why this shouldn't be an option for a relying party?
Best wishes,
Phil Lello

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150413/5edb1f1c/attachment.html