[JIRA] (IDP-1920) Attribute release activation condition is SAML-specific.

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1920 ( https://shibboleth.atlassian.net/browse/IDP-1920?atlOrigin=eyJpIjoiYmNmNDBiYmQ5NmFjNDBhMDhjMGQzNGRhMDc4YTdmNzMiLCJwIjoiaiJ9 )

Re: Attribute release activation condition is SAML-specific. ( https://shibboleth.atlassian.net/browse/IDP-1920?atlOrigin=eyJpIjoiYmNmNDBiYmQ5NmFjNDBhMDhjMGQzNGRhMDc4YTdmNzMiLCJwIjoiaiJ9 )

It’s in profile-intercept-system.xml, the control for the attribute-release flow. It’s implemented as:

(User-supplied condition AND (NOT (per-attribute consent enabled) OR profile has includeAttributeStatement enabled))

The includeAttributeStatement predicate is currently:

* If SAML SSO, check includeAttributeStatement
* If SAML AttributeQuery, true

It’s false for CAS and OIDC, which is the source of the immediate bug, but the deeper I looked at it, the less I understood why it’s there at all. I think it may have been a defense against the original code that did not check consent records on queries (and still doesn’t for CAS).

But I can’t understand what the per-attribute setting has to do with it. If consent stores the attribute IDs (which I thought it did, but maybe it doesn’t?), then that seems just as possible to honor on the back-channel as if it’s all or nothing.

( https://shibboleth.atlassian.net/browse/IDP-1920#add-comment?atlOrigin=eyJpIjoiYmNmNDBiYmQ5NmFjNDBhMDhjMGQzNGRhMDc4YTdmNzMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1920#add-comment?atlOrigin=eyJpIjoiYmNmNDBiYmQ5NmFjNDBhMDhjMGQzNGRhMDc4YTdmNzMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:81e20ed )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/4cda6f98/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-60ca7b7f-99c6-40e2-aced-2a4c7e965393
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/4cda6f98/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-15e369ee-a4fb-463a-b7f7-546832c198e1
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/4cda6f98/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d8dc0c08-e05f-4529-bcb9-3b657900b46e
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220314/4cda6f98/attachment-0005.png>