<div>I confirm that direction.</div><div>Especially for one function: auto-provisioning.</div><div>SPs in the cloud allow the creation "on the fly" of user account based on the SAML assertion. </div><div>But, when one account means one license, and then money, it is interesting to filter user that are able to connect to this particular SP.</div>
<div><br></div><div>I do not know much about Shibboleth IdP but I'm pretty sure it is possible to insert some filtering/authz logic in the pipeline, based on some attributes for instance.</div><div><br></div><div>Yannick</div>
<br><div class="gmail_quote">On Thu, Aug 16, 2012 at 4:25 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 8/16/12 10:16 AM, "Kevin P. Foote" <<a href="mailto:kpfoote@iup.edu">kpfoote@iup.edu</a>> wrote:<br>
><br>
>Ha, I started typing my reply in that vein.. but realized that the OP's<br>
>issue was<br>
>not "really" authn (same ldap) but rather authz on the SP side.<br>
<br>
</div>Yeah, assuming the SP will actually do authz. One of the clear directions<br>
of the "cloud" is that a lot of IdPs are going to be doing a whole lot of<br>
things they aren't supposed to have to do. Hard to see how the average<br>
vendor will do an adequate job when Google can't even manage it.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>