title: LDAP vs SAML Authorization
body: <p>I'm currently investigating moving an asset tracking system from LDAP to SAML. There are two main areas where our software currently uses LDAP. The first is authentication. In order to access the system today you need to successfully authenticate with LDAP and be a member of a specified LDAP group. That part is fairly simple to move over to SAML. We've utilized a library to handle most of the dirty work. And on the IDP we can add a claim to authorize the user. But our second use of LDAP is throwing me for a loop.</p>
  
  <p>Today, each asset that we maintain has the ability to be linked to a username. For example, a particular printer may belong to 'someuser'. One of the options our software gives the administrator is to view/interact with assets based on LDAP user groups. So as an administrator, I may want to update all the printers that are owned by people in a particular department. To accomplish this, the administrator would create a rule scoped to the LDAP group 'departmentInQuestion'. Our software would then use a service account to connect to LDAP, create a query to see which users from our system are in 'departmentInQuestion', execute that and use the results to determine which assets should get the update.</p>
  
  <p>So far from my searching I have not been able to find a SAML workflow analogous to this. It appears the only opportunity we have to asses 'someuser' is when they authenticate and we get access to their claims. But in our workflow 'someuser' may never authenticate with us. It's almost as if we're using authorizing a user on behalf of the service account. Is there an existing workflow that I've overlooked during my exploration? Are there any other technologies that support authorization in this manner? </p>
  
  <p>Thanks for any input! </p>