...
- Have conversations with the providers of services and resources made clear what information about users will be relevant to the service providers' decisions:
- whether or not to grant access (for example, status - such as status as current currently enrolled or current instructor)?, or
- level of, or restrictions to access? (for example based on age or grade level, role as instructor/administrator/student)?
- Who or what should be the authoritative source for each of these attributes?
- Do internal Service/Resource accounts exist for users of the service?
- If so, describe how those are provisioned (e.g. file upload, vendor-provided API, SAML assertion)
- Has it been decided where the Identity Provider will run? What credentials the users will use to authenticate?
- If so, please describe