[JIRA] (IDP-1856) Session-specific consent not visible for the backend flows

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/IDP-1856?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 ) IDP-1856 ( https://shibboleth.atlassian.net/browse/IDP-1856?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 ) Session-specific consent not visible for the backend flows ( https://shibboleth.atlassian.net/browse/IDP-1856?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) Components: Attribute Consent Created: 20/Aug/21 11:32 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The default attribute-release view offers three options for the user:

* Ask me again at next login (session specific)
* Ask me again if information to be provided to this service changes
* Do not ask me again (global consent)

If the first option is chosen, the consent is not stored to the configured storage service. In practise it means that this session-specific consent works only when the front-channel flow returns the consented attributes. If any backend flow resolves attributes again and call attribute-release-query, all the attributes are filtered out as no consent record exist.

The OIDC OP plugin has a capability to encode the consented attributes inside the tokens that are later used for the backend calls, but currently there’s no obvious way to notice that the consent has not been stored. The end-user’s choice is internal to the attribute-release flow. If the choice was visible to the plugin somehow, the plugin could always chose to encode the consent inside the tokens. Currently that option is handled globally via a configuration option, defaulting to not to encode it and thus exploit consent storage instead.

( https://shibboleth.atlassian.net/browse/IDP-1856#add-comment?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1856#add-comment?atlOrigin=eyJpIjoiMzhiYmRlNGZjN2JlNDRkYTg5MTA4NDI1ZDhhMmQ3Y2EiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100174- sha1:8523140 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20210820/f2c48000/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-0be43e8e-4c9a-464c-bd31-60bf988d9156
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210820/f2c48000/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-a23539ee-2e84-4c2e-acce-2f39a1626a37
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210820/f2c48000/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-4d2e19bd-1d19-479f-a503-02385f50226f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210820/f2c48000/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-5cf7132f-b09d-4f3a-8a17-154bfb74537b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210820/f2c48000/attachment-0007.png>