 |
 |
Thanks Ian,
In this case the IdP contracts with the SP ("BBB.COM") to provide an information service to third parties, and individual permission is granted by the subject (student) directly using oAuth. However that still probably needs spelling out in policy and checking against the UKAMF T&Cs as you say.
Cheers,
S