It would be difficult for the application service provider to maintain agreements with hundreds of such organizations in order to verify assertions made by those parties. Instead, it chooses to check the key of the asserting party to ensure that the asserting party is a 4-year university. Student authenticates to university security system. University provides authentication document to student application, including authentication event data and authorization attributes. Student application requests resource from application service provider.
Request includes authentication document.
Application service provider makes a trust decision about the authc and authz data, based on the key used to sign the assertion. It determines that the signing party is an accredited 4-year university, based on a signature on the key made by an accrediting organization. Application service provider makes an authorization decision based on the authz attributes of the student. Application service provider returns resource to the student. Add this use case scenario to the use case document.