<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body style="word-wrap:break-word" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div><br>
</div>
+1 and nominate for carving in stone...
<div>
<div>
<div><br>
<span style="font-family:'Segoe UI',Helvetica,Arial,sans-serif"></span>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px"><font face="Segoe UI, Helvetica, Arial, sans-serif">--------------------------------------------------</font></div>
<div style="font-family:Tahoma; font-size:13px"><font face="Segoe UI, Helvetica, Arial, sans-serif">Mark Rank</font><br style="font-family:'Segoe UI',Helvetica,Arial,sans-serif">
<span style="font-family:'Segoe UI',Helvetica,Arial,sans-serif">Project Manager - Identity & Access Mgt</span></div>
<div style="font-family:Tahoma; font-size:13px"><span style="font-family:'Segoe UI',Helvetica,Arial,sans-serif">UCSF Information Technology Services (ITS)</span><br style="font-family:'Segoe UI',Helvetica,Arial,sans-serif">
email: mark.rank@ucsf.edu</div>
<div style="font-family:Tahoma; font-size:13px">phn:414-331-1476</div>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px"><font face="Segoe UI, Helvetica, Arial, sans-serif">--------------------------------------------------</font></div>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF265513" style="direction: ltr; "><font face="Tahoma" size="2" color="#000000"><b>From:</b> users-bounces@shibboleth.net [users-bounces@shibboleth.net] on behalf of David Bantz [dabantz@alaska.edu]<br>
<b>Sent:</b> Tuesday, September 03, 2013 11:28 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Shibboleth implementation for an application<br>
</font><br>
</div>
<div></div>
<div>
<div><br>
</div>
<div>
<div>
<div>On Mon, 2 Sep 2013, at 08:52 , "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite"><span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">The
application needs to determine the appropriate set of</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">attributes
it needs to obtain from IdPs to operate, and then it needs to</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">enforce
a policy based on them about who gets access.</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">You
also need a strategy for provisioning and dealing with the way new</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">users
are added, because unlike LDAP, you don't get to assume that the</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">universe
is that LDAP server. Federation doesn't work like that. The set</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">of
potential users is essentially infinite and not accessible to the app</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">at
any time for examination, and there will almost always be users who can</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">authenticate
to the IdP but should not have access to the app. You cannot</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">punt
that decision to the IdP unless you require some kind of entitlement</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">string
be provided by the IdP to indicate that some policy has been</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
<span style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px; display:inline!important; float:none">enforced
at the IdP.</span><br style="font-family:Helvetica; font-size:medium; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:2; text-indent:0px; text-transform:none; white-space:normal; widows:2; word-spacing:0px">
</blockquote>
</div>
<br>
</div>
<div>Great < 150 word summary of critical point that too many app administrators haven't internalized.
<div><br>
</div>
<div>David Bantz</div>
</div>
<div>U Alaska</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>