minimizing system directory changes

[Cantor, Scott]

On 1/27/16, 2:18 PM, "users on behalf of cneberg" <users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:



>In a university use case, or any use case where ownership of the data is different then the identity provider I see your point - but I think I'm representing a new corporate use case where the identity provider does also own the data 

Not new at all, but it tends to lead to a sloppy separation of concerns that doesn't work well at scale.

>- many cots in house products now come with SAML support. I've seen shibboleth 3 or maybe it was incommon email last year about what should the future of the shibboleth 3 identity platform be - and I guess one enhancement request at a time I'm bringing ideas into the mix.

Having the IdP do authorization is not a new idea, but it was always something approached with a large grain of salt.

Also, the main goal of the new platform was radical extensibility, i.e. making things we didn't agree with much easier to build with small amounts of code so that we weren't the gating factor. In this case, your goal of authorization is really secondary to the question of what hooks exist or might be missing.

I don't know that, upon studying it, I'll conclude that the right place for this isn't there already with the outbound intercept hook. The only reason I was initially not thinking that way is efficiency, since that runs rather late and we can probably do something a little less late in the sequence.

-- Scott