[JIRA] (IDP-1920) Attribute release activation condition is SAML-specific.

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1920?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 ) IDP-1920 ( https://shibboleth.atlassian.net/browse/IDP-1920?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 ) Attribute release activation condition is SAML-specific. ( https://shibboleth.atlassian.net/browse/IDP-1920?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5 Assignee: Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) Components: Attribute Consent Created: 14/Mar/22 9:04 AM Fix Versions: 4.2.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

There’s a built-in activation condition on the attribute-release flow that seems to date back pretty close to the original 3.0 or shortly after. It evaluates (includeAttributeStatement OR NOT per-attribute consent enabled) as a part of the condition, and the code for the former is SAML specific and doesn’t account for CAS or OIDC.

That’s relatively easy to fix but I don’t know why the second half of that logic was included, hoping maybe Tom Zeller ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A0fa99aa9-d698-454c-a274-7a41bee6cef5 ) might recall. IIRC, we store off the attribute IDs in the consent record, so even in SAML, the consent stored should be enough for an attribute query case to retrieve the record and filter out the non-consented attributes. Values are a problem if they change but that’s a problem even without per-attribute consent.

I’m not sure there’s a reason to have that check anymore, actually. We might have an issue with the CAS validate flow not running the consent flow (i.e. like the SAML queries used to omit) but leaving that aside, it seems like there’s no reason to care at this point whether attributes are being included or not, since there’s a check being run on the queries (and we do the same in OIDC).

I was originally going to refactor the predicate to account for OIDC but now I’m thinking the real fix is to just remove the old condition entirely and leave it to whatever the deployer sets. What breaks if we do that?

( https://shibboleth.atlassian.net/browse/IDP-1920#add-comment?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1920#add-comment?atlOrigin=eyJpIjoiNTZkOGEyNThkZTZlNGJjNzkzMjg3ZjliZWIxMDJjYWMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:81e20ed )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/9cdfbab6/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-9782c446-3ed4-40bb-b757-8996716a08c8
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/9cdfbab6/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-965ee146-2e03-450a-bbc3-ea08f83f049f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/9cdfbab6/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c9120cc7-e52c-4edf-8897-341d71254cdd
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/9cdfbab6/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-55b009ab-aebe-4c4c-b8bb-ce63963693af
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/9cdfbab6/attachment-0007.png>