Access control using only IdP entityID

[Cantor, Scott]

On 2/27/15, 6:12 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Lukas Hämmerle <lukas.haemmerle at switch.ch> [2015-02-27 12:04]:
>> I would like to create an Apache access control rules that grants access
>> to users of one or more particular Identity Providers based on their
>> entityID. Ideally, without having the IdP to release any attribute or
>> persisent NameID.
>
>This should be possible as a side effect of other changes to the SP,
>and doing this has been actively discouraged by the project for many
>years now. As such my explanation below isn't as explicit as it could
>be. ;)

Yes, it used to be deliberately impossible because this is almost always a 
bad idea. It's now deliberately possible but extra work, by extracting the 
entityID out of the assertion with the special plugin and populating that 
into an attribute as desired.

Still a very, very bad idea.

-- Scott