'Check if we require the presence of any specific eduPersonEntitlement.
raise AuthForbidden if the user should not be authenticated, or do nothing
to allow the login pipeline to continue.'

def _check_entitlements(self, idp, attributes):

    if ('requiredEntitlements' in idp.conf):
        entitlements = attributes.get(OID_EDU_PERSON_ENTITLEMENT, [])
        for expected in idp.conf['requiredEntitlements']:
            if (expected not in entitlements):
                log.warning('SAML    user    from    IdP    %s    rejected    due    to    missing    eduPersonEntitlement    %s', idp.name, expected)
                raise AuthForbidden(self)
