eduPersonEntitlement Format

[Cantor, Scott]

> From the SP's point of view, specifying a value (in the SP's
> namespace) and requiring that of all IdPs is a reasonable thing to do
> IMO.

It is if the SP has some specific global notion of its access policy, but generally they don't. A common case is for the IdP to map users into various buckets in the application by means of entitlements (really groups, but they're the same thing in a flattened non-LDAP view of the world) and so the simple thing is to let the admin assign entitlements to the buckets in the application. WebAssign works that way for example.

-- Scott