minimizing system directory changes

[Cantor, Scott]

On 1/27/16, 1:12 PM, "users on behalf of cneberg" <users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:


>
>Interesting I assumed it would be a popular.   Having a central way to control even loose authorization is powerful.

I think it's misguided. One of the differences here is that Shibboleth was designed around a world in which the resources being protected were not owned by the IdP's organization, and enterprises using federation really care much more about the case where they are. If you own the resources, you certainly can't expect me to enforce the access control for you (vs. me providing the data to help determine the decision).

My experience is that creating rules at the IdP is inflexible and leads to unanticipated consequences when people figure out how to exploit the weird policies people try and make the IdP apply. A common example of that is when managers try and force us to deploy "simple" rules based on user affiliation or role, and are totally incapable of understanding that roles overlap routinely.

-- Scott