I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization).
The part about authentication is mostly solved (probably going to use SAML). The more difficult part is implementing a centralized authorization, if even possible.
The only possibility I see to make this work would be that the resource providers ask the authorization server about the permissions of a specific user. The resource provider would then have to map those permissions into local rules for the user. The problem with this is that it is still up to the resource provider to respect and implement the policy provided by the authorization server.
Is there a solution to have the central server enforce user permissions/policies?