Context Check Intercept for AuthZ

[Schwoerer, Brad]

Before I go about trying to piece together a context check intercept for AuthZ, I wanted to see if anyone has already accomplished what I am looking for to hopefully not have to invent the wheel.

I am looking to create a directory based (LDAP) way to deny certain individuals to certain entityIDs.  It seems there are two approaches.  1) Use LDAP groups with an attribute that has the SP entityID and membership of people that are NOT allowed access to the SP.   2) A multivalued user attribute with the entityIDs that the user is not allowed to access.  The first approach has the benefit that it is easier to delegate group membership than managing a shared attribute for an individual.  The second approach has the benefit of easier to see what a user can't access.

It doesn't matter to me which of the approaches are used from and LDAP perspective, as I can use our identity management solution to express it as either.  Wondering if anyone has either of those methods build already and are willing to share.

It does appear that 3.4 will make this better, but we aren't there yet, and my deadline is before it would be released.

-Bradley

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170330/4b0086c1/attachment.html>