<div dir="ltr"><div>Our approach is to only release the requested attributes (including eppn) only when the user has a "box" entitlement (eduPersonEntitlement) in our LDAP backend. If the entitlement is absent or gone, the login will fail.<br><br></div>Regards,<br><br>Claudio<br></div><div class="gmail_extra"><br><div class="gmail_quote">2014-10-30 20:29 GMT+01:00 Gary Chapman <span dir="ltr"><<a href="mailto:gary.chapman@nyu.edu" target="_blank">gary.chapman@nyu.edu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi, we are finalizing a SAML 2.0 integration with Box.com.<div><br></div><div>We've been told that Box cannot support a common approach we take</div><div>of releasing an eduPersonEntitlement value - the presence of which</div><div>signals the SP to allow the incoming user to use the service, and the</div><div>absence of which signals the SP to disallow access to the incoming user.</div><div><br></div><div>Does this sound correct (i.e. no Box support for this approach) to those</div><div>of you who've done SSO integrations with Box?</div><div><br></div><div>Thanks - Gary Chapman, NYU</div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>