can a service provider validate an authorization delegation?

[Cantor, Scott]

On 2/1/17, 11:35 AM, "users on behalf of Robert Duncan" <users-bounces at shibboleth.net on behalf of Robert.Duncan at ncirl.ie> wrote:

> e.g. user A delegates a role to user B - is there any method by which to check if user A is still a member of the
> organization?

The only feature that pertains to an SP asking arbitrary questions about an arbitrary subject is the attribute query, which most IdPs increasingly don't support and wouldn't support in the manner you mean anyway. There are some federations with smallish membership and more control that rely on queries together with persistent identifiers of whatever sorts to do liveness checks. It happens, but it's not a widespread thing.

> If the application has a read only view of ldap this is possible by checking if the account is enabled/exists - is there any
> similar way of asking ECP the same question.

Not without profiling specific methods that you could never rely on unless you control all the players, just like in the LDAP case. You can always take an enterprise scenario and implement it with just about any technology.
 
> - cloud application such as AWS and OpenStack often use trustor/trustee model of delegation, the trustee can be a service
> account that acts on behalf of the user (e.g. scale up) - so is there any known way of placing a condition on this type of
> authorization while using SAML.

The IdP has been the vehicle for that condition. I get what you're asking, and I guess the answer is that as much as it would be nice to get the IdP off the hook from actually regulating the delegation, I don't think it really works outside the firewall.

Possibly there would be a big push to profile and adopt a basic mechanism for this if there were real extant adoption of federated authorization models, but to be honest, you just named AWS, literally the only application I have encountered in 17 years of working on this that actually requires, or even accepts the idea of, federated authorization. And that's stil a single IdP play. Which I guess answers your question: AWS doesn't implement it, but if you were the SP and you operated the IdP, yes, you can set up use of queries for this. SWITCH has examples of this in our wiki somewhere I believe, or at least elsewhere on the web.

-- Scott