monitoring and non-person IDs

[Jerry Shipman]

Hello,

(This might not be the right list for this question, but I thought that people on here would know what I mean and have suggestions. Apologies if I am doing that wrong.) 

We have a web application that is moving from on campus to being vendor-hosted in "the cloud", and as part of that move the authentication is changing from our internal system to shibboleth. The vendor is a member of incommon and the SP is registered.

The campus group responsible for the application monitors its health with an automated process. The monitoring process uses a non-person ID (serviceid, holdingid, etc) to log in to the application and validate that the application is working. (I don't know the details, but for the sake of argument say that it logs in and presses some buttons, then parses the output, to verify that the application is functioning. Or something like that.) 

It seems like there may be policy or trust reasons why we would not want to do that same kind of authentication with a federated identity. i.e., if we set that same monitoring up to work with shibboleth, it would be possible for that non-person ID to wind up on another inCommon SP because our IdP is part of the federation. (It shouldn't happen, but it would be possible.)

Does anyone have recommendations on how to monitor a shibboleth-protected SP with a non-person ID in a reasonable way, given that our IdP is a member of the federation?

For example, 
 - maybe it is acceptable if we don't assert any eduPersonAffiliations for that non-person ID?
 - I might be able to do something in the attribute-filter.xml to restrict that specific user to only being able to log in to that specific SP (i.e. by not releasing any attributes to any other SP, so they just get an empty assertion -- sort of ugly). I haven't looked into that option enough yet to be able to tell whether it is feasible. 

What have other people done? Is there a standard solution? Or does anyone have any suggestions?

Thanks a lot for the help,
Jerry Shipman