Can Shib 3 deny access to certain SPs based on a user attribute?

[Glen Shere]

A person's presence in a directory, and consequent ability to authenticate,
must not imply authorization to any particular service.

The vast majority of the people in our directory are "ex-students"; they
are alumni of the University.  Transcript requests and our alumni community
portal are two services offered primarily to this population.  Many
continue to use their e-mail as well.  Some "ex-students" leave for one
reason or another and then return; they need to, among other things, use
their log-in to register for class.



On Thu, Oct 15, 2015 at 11:38 AM, Dave Perry <Dave.Perry at hull-college.ac.uk>
wrote:

> This may seem an odd question but why are your ex students allowed to
> actively login to an institution system? A month after ours finish, they
> are locked out of AD ergo can't access anything.
>
> Dave
>
> _________________________________________________
> Dave Perry
> eLearning Technologist, Hull College Group
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
> Extension 2230 / Direct Dial 01482 381930
>
> * Need a fast reply? Try elearning at hull-college.ac.uk *
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jessica
> Coltrin
> Sent: 15 October 2015 16:37
> To: users at shibboleth.net
> Subject: Can Shib 3 deny access to certain SPs based on a user attribute?
>
> Can Shib 3 deny access to certain SPs based on a user attribute? Our use
> case is that we want former students who are not currently active to have
> access to only certain SPs and we'd like to control that with Shibboleth
> based in an attribute indicating status. Is this possible? If not, how do
> others handle this use case?
>
> Thanks,
> Jessica
>
> Sent from my iPhone
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> **********************************************************************
> This message is sent in confidence for the addressee
> only. It may  contain confidential or sensitive
> information.  The contents are not to be disclosed
> to anyone other than the addressee.  Unauthorised
> recipients are requested to preserve this
> confidentiality and to advise us of any errors in
> transmission.  Any views expressed in this message
> are solely the views of the individual and do not
> represent the views of the College.  Nothing in this
> message should be construed as creating a contract.
>
> Hull College Group owns the email infrastructure, including the contents.
>
> Hull College Group is committed to sustainability, please reflect before
> printing this email.
> **********************************************************************
>
> TEXT
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151015/3fdf3328/attachment-0001.html>