...
The specific format of these entitlements depends on their issuer.
| Info |
|---|
For security reasons, entitlements from the home Identity Provider which have the same issuer as the current Perun IdM instance are discarded. |
Group entitlements
ProxyIdP releases entitlements also based on group membership and groups assigned to the service in Perun IDM. For convenience, ProxyIdP will release an entitlement value for each group that the user is a member of if that group is assigned to a resource on the facility that represents this service.
...
<NAMESPACE>:group:VO1:Group%20C#<AUTHORITY><NAMESPACE>:group:VO2:Group%20D#<AUTHORITY>
If you want to disable group entitlements (because you do not use them), you can set the “Disable group entitlements” attribute on resource where you do not want group entitlements.
This feature is currently in beta and is not available on all Perun instances.
Resource capabilities
To prevent access control from breaking when groups are renamed or moved in the group hierarchy, we highly recommend using entitlements in the form of resource capabilities. This form of entitlement effectively represents an M:N mapping of groups to entitlement values; multiple groups may be mapped to the same capability, and also one group may grant users multiple capabilities.
...