Assurance

[Eric Goodman <>]

> Could they use a guest account in your IdP restricted to their SP? Not the same as a machine account but it would allow them to login unless you expire the account.

Brendan

That's more or less what I outlined earlier: using Shib filters to only release the required data to a specific SP. I was thinking it would be technically easier to use a filter to add the IAQ to the account only for this specific vendor (rather than to try to suppress the release of the account for all other SPs).

A separate issue for us is that we don't currently have a process to assign an IAQ to our guest accounts (as compared to employee/faculty accounts), but that's really our problem and not something I mean to burden the list with solving for me. :)

--- Eric