Correct SAML error if an IDP knows a user but won't authenticate

Jeremy French 0
Viewed 16

I have a working setup with a custom plugin to Simplesamlphp. My implementation is on the IDP.

The client has asked me to make SSO login only work for a subset of users. I'm fairly confident that I know where to alter my plugin to restrict this. What I am not sure about is what response the IDP should return in such a case.

I can see an error code urn:oasis:names:tc:SAML:2.0:status:RequestDenied

The SAML responder or SAML authority is able to process the request but has chosen not to respond. This status code MAY be used when there is concern about the security context of the request message or the sequence of request messages received from a particular requester

This doesn't quite seem right. It is not a security context we are worried about. But none of the other error codes seems quite right either. The error is not on the part of the SP or the request itself but due to the user who is making the request.

Should I even be making a SAML response at all? It would be nice if the user went back to the SP with a nice message but perhaps the message should be displayed to them on the IDP.

Is there a correct way to handle this situation?

saml simplesamlphp
1 Answers

If you want to negotiate access based on types of user you can use the eduPersonEntitlement attribute.

e.g. if you are only allowing access to the SP to users who are on a course called BSc Computing, you can ask the people who run the IdP to release eduPersonEntitlement if the user is on that course. The IdP should know if they are. The value can be whatever you want, e.g.

https://sp.entitlement/access

If eduPersonEntitlement is not present in the SAMLResponse, or is but has a different value, don't let the user in to the SP.

codebrane0
Related