IdP user filtering

[Peter Schober]

* Larissa Riedel <larissa.riedel88 at gmail.com> [2017-07-04 18:54]:
> does the IdP provide functionality to allow/deny a user based on LDAP
> attributes for a certain SP?
> In our federation are SPs which can cause costs. We want to avoid that
> particular users can access those services. Because these services are not
> maintained by our organization, we want to make the decision on the side of
> the IdP.

The general and recommended model for that is to send the required
attributes to the SP and let the SP enforce access control. If a
person does not carry the necessary attributes the SP should deny
access.

There are SPs that refuse to implement proper access control, though,
and for those the IDP can "intercept" the request, depending on
"context". See

https://wiki.shibboleth.net/confluence/display/IDP30/ProfileInterceptConfiguration
and
https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

for a start (and example for a simple attribute check).
-peter