Using isMemberof Attribute to release specific group membership

[Cantor, Scott]

On 3/30/16, 12:57 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>From my experience, it makes sense to release all values that the service provider might potentially be interested in, then let the SP decide what to do with it. In your case, I'd release all three possible values to the SP and let it give access based on the highest possible value.

It really depends. If that means releasing 100 values, including all your course enrollments, probably not so much.

>Seems like, to do it from the IDP, you'd need to invent a new attribute (it could have the same oid as isMemberOf) and populate it with the highest possible group using a scripted attribute definition. This is more complex and less elegant, though, then just letting the SP make the decision.

That is one way, just depends on how much knowledge you can bake into the IdP (or maybe more to the point the IDM side, where you could produce custom groups for an application so it gets only the data it needs).

Anyway, if you want to do it in the filter, you create a policy whose PolicyRequirementRule is based on the value of an attribute, and then release the data you want in that case.

-- Scott