Adding a context-check on the fly

[Cantor, Scott]

On 2/13/17, 8:37 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:

> If we are satisfied with a common error message ("Access Denied - blah 
> blah"), is there a reasonable way to handle multiple SPs?

Probably by tagging them and including a check for the tag in the condition.
    
>  We could abstract the eligibility information into an attribute named 
>  "<service>-eligible", but I'm not sure how to link that to an SP (by 
>  entityID?)...  Is this a common pattern with a common solution?

If you mean a user attribute, I'm sure there's some way to encapsulate this all in the resolver, but if you want to base the condition itself on the SPs, the only way it could be dynamic is through an EntityAttribute tag applied to the metadata (or an EntitiesDescriptor group, but that's only workable for locally maintained metadata).

-- Scott