can a service provider validate an authorization delegation?

[Robert Duncan]

Thanks Scott,

What I mean is if an application is federated and also includes role delegation as part of its authorization implementation, e.g. user A delegates a role to user B - is there any method by which to check if user A is still a member of the organization?
If the application has a read only view of ldap this is possible by checking if the account is enabled/exists - is there any similar way of asking ECP the same question. - cloud application such as AWS and OpenStack often use trustor/trustee model of delegation, the trustee can be a service account that acts on behalf of the user (e.g. scale up) - so is there any known way of placing a condition on this type of authorization while using SAML.

Rob.


----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday 1 February 2017 14:49
To: Shib Users <users at shibboleth.net>
Subject: Re: can a service provider validate an authorization delegation?

On 2/1/17, 9:10 AM, "users on behalf of Robert Duncan" <users-bounces at shibboleth.net on behalf of Robert.Duncan at ncirl.ie> wrote:

>    A service provider implements a trust model for federated users to
> perform actions on an API - say, auto scaling a cloud app. Can the service provider verify the existence of the federated user (trustor) to authorize the trustee?
> e.g. a simple revoke/approve metric

Whatever you're trying to ask, I have no idea what you mean by it.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance.
________________________________