SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) that authenticate against the IdP via saml protocol, is there something the application could use in the saml response from the IdP to pass to the Permission Service Provider to authenticate the request?
In an OAuth2 world I presume this is done via the OAuth token but I am unfamiliar with SAML.