Federated Authorization

[Dick Hardt]

Hi James


In the examples I was wanting to demonstrate that the Hospital would  
not issue a claim that the surgeon is part of the team unless the  
Hospital was presented with a valid claim from the College of  
physicians and surgeons that the surgeon is still a surgeon.

In your example are you wanting to express a use case that the  
College would be specifying a quantity of procedures that the Surgeon  
is permitted to perform?

btw: I prefer not to use the term "identity" in the context you have  
used below. It is too overloaded of a term :-)

-- Dick

On 25-Jan-07, at 1:49 PM, McGovern, James F ((HTSC, IT)) wrote:

> Attempting to figure out to model deeper authorizations that aren't  
> based solely on the identity and require additional information. In  
> your first example, it didn't take into consideration what the  
> individual can do, only that they had different identities which  
> needed to be correlated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs/attachments/20070125/b8ec2576/attachment-0002.htm>