[JIRA] (IDP-1919) attribute-release not working on OIDC (or CAS) when using idp.consent.allowPerAttribute

[Clemens Bergmann (Jira)]

Clemens Bergmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=617bb50a5800630069a5b0f0 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/IDP-1919?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 ) IDP-1919 ( https://shibboleth.atlassian.net/browse/IDP-1919?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 ) attribute-release not working on OIDC (or CAS) when using idp.consent.allowPerAttribute ( https://shibboleth.atlassian.net/browse/IDP-1919?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 )

Issue Type: Improvement Affects Versions: 4.1.5 Assignee: Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) Components: Attribute Consent Created: 14/Mar/22 8:56 AM Priority: Trivial Reporter: Clemens Bergmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=617bb50a5800630069a5b0f0 )

When adding 'intercept/attribute-release' as postAuthenticationFlows in OIDC.SSO or CAS.LoginConfiguration the consent is not shown when idp.consent.allowPerAttribute is set to true.

The Reason is that the activationCondition of shibboleth.consent.AttributeReleaseFlow ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml#l50 ) would in that situation call net.shibboleth.idp.saml.profile.config.logic.IncludeAttributeStatementPredicate ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/IncludeAttributeStatementPredicate.java#l74 ) which unfortunately only tests for SAML Profiles.

Therefore the Attribute Release Flow is never shown.

Additionally this also means that when using the OIDC “Authorization Code Flow“ in this setup claims are never returned in the id_token because it can never find a matching consent.

( https://shibboleth.atlassian.net/browse/IDP-1919#add-comment?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1919#add-comment?atlOrigin=eyJpIjoiMjhhNjRlYjljMjM3NDkxMTk2NzU3Y2QzZDA3MWYyY2YiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:81e20ed )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/ee743a00/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-ca9d0c7a-2dbf-4573-88fb-6925e2fcc515
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/ee743a00/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9a82c619-d724-4c91-9439-3f0914406d6d
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/ee743a00/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-1e93caae-896a-4989-8c46-b6a34ce4369f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/ee743a00/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-0de91434-dd97-44fa-9f6d-969beb690fad
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/ee743a00/attachment-0007.png>