Q:

How to determine authorization rights after a login via SAML SSO

First of all I do not have any experience with SAML (version 2). 
I was asked to investigate how we can make an existing site, which has a normal login page with a username and password page, ready for SSO with SAML. 
There are some tools around which we can use in order to do this. 
So I think it is not so difficult to implement the SSO part. 
But however it is not clear to me how the authorization is managed. 
The system (web site) is using authorization rights in order to determine if the user is able do access certain parts and if he does, the right type he has (view, create or edit). 
These rights are assigned to each user by an administrator in the system itself. 
When a user logs in the system by specifying his credentials (without SAML/SSO) his rights are also retrieved. 
How is this done when a person logs into the site by using SSO? 
Is there a mapping of the userId which is know by the IdP (Identity Provider) to the userId which is know by our system? 
And is this send in the SAML response from the IdP? 
Or is this done in another way? 
Thanks in advance

A:

SAML is mainly a authentication protocol but there are still many ways to solve this.  SAML supports sending authorization infromation in AuthzDecisionStatement in the assertion.  
Another alternative is to extend SAML using XACML which is a big framework for transferring Authz information. 
However the support for these are limited in many SAML providers. 
The simpler solution and probably the best in your case, if it is just one access right per user, is to send it as an attribute in the SAML assertion.  This can usualy be mapped against for user properties.