Authorization using OpenID?

[creimer at xs4all.nl]

Dear list,

I searched the mailing list archives for authorization issues and googled
for it, too. In the mailing list archives nothing was said about
authorization issues and the google results I found mainly pointed out
that OpenID is only for authentication purposes.

To clarify: Authorization in this context means to decide wether an
already authenticated user (e. g. by the OpenID-protocol) may use a
special ressource or not.

The intended use case:

With our company we would like to use OpenID to enable users to use
several applications with a signle sign on mechanism (like OpenID). But
not every user may use every application so we need some authorization
mechanism to distinguish the users who may from those who may not. Is that
something OpenID can do or help to do?

And if so, how can this authorization be achieved. I read through the
specs (v1 and v2) and did not find anything appropriate. Are the
properties introduce in v2 something that might help?

Thanks in advance for any hints, suggestions etc.

With kind regards

Carsten Reimer