<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
On Dec 2, 2014, at 6:59 AM, Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com" class="">pioneer.suri@gmail.com</a>> wrote:<br class="">
<div>
<blockquote type="cite" class=""><br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<div class="">Thank you for your reply, but you are saying attributes pulled from resolver:</div>
<div class="">Is that attribute-resolver.xml, configured for releasing attributes, in that case</div>
<div class="">i am releasing 'principal' which contains 'permissions' to SP. Is that right?</div>
</div>
<br class="Apple-interchange-newline">
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">attribute-resolver.xml defines attributes and the sources to obtain those attributes. That includes the “principal” and anything else you might define.</div>
<div class=""><br class="">
</div>
<div class="">attribute-filter.xml defines which SP’s get which attributes released to them.</div>
<div class=""><br class="">
</div>
<div class="">None of that is “permissions” in the sense that to the IdP the attributes are opaque values sent to an SP. There is no inherent meaning of those attributes at the IdP level. At the SP level it has to define what those attributes mean.</div>
<div class=""><br class="">
</div>
<div class="">Paul </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<br class="">
<div apple-content-edited="true" class="">——<br class="">
<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
<br class="">
</div>
<br class="">
</body>
</html>