Restrict attribute values based on SP entity?

[Cantor, Scott]

> I can understand your point, so are there other options for doing
> something like this that doesn't involve making code changes to a
> backend application, or having control of the IdP?

No, it's assumed to be mostly an application function. All the SP tries to do is enforce some controlled vocabularies and the scope filtering.

>  I'm always open to
> doing things the "right" way.  But I think many people are in the
> position of having control over the SSO/SP layer but not the other
> parts of the system.

It's unusual to not have control of the application but actually have to do this kind of thing.

-- Scott