[java-identity-provider] branch main updated: IDP-1856 - Session-specific consent not visible for the backend flows

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=26fce963e4840e31df08485416aa076f898a0744

The following commit(s) were added to refs/heads/main by this push:
     new 26fce963e IDP-1856 - Session-specific consent not visible for the backend flows
26fce963e is described below

commit 26fce963e4840e31df08485416aa076f898a0744
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 14 11:57:19 2022 -0400

    IDP-1856 - Session-specific consent not visible for the backend flows
    
    https://shibboleth.atlassian.net/browse/IDP-1856
    
    Partial help with flag in AttributeContext as a signal on front-channel.
---
 .../idp/attribute/context/AttributeContext.java    | 45 +++++++++++++++++++++-
 .../idp/flows/intercept/attribute-release-flow.xml |  4 ++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/context/AttributeContext.java b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/context/AttributeContext.java
index 93ba16a96..bd5de7157 100644
--- a/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/context/AttributeContext.java
+++ b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/context/AttributeContext.java
@@ -47,6 +47,9 @@ public final class AttributeContext extends BaseContext {
     /** The attributes tracked by this context prior to filtering. */
     @Nullable private Map<String,IdPAttribute> unfilteredAttributes;
     
+    /** Whether attribute release consent was obtained from the subject. */
+    private boolean consented;
+    
     /** Constructor. */
     public AttributeContext() {
         unfilteredAttributes = Collections.emptyMap();
@@ -66,8 +69,11 @@ public final class AttributeContext extends BaseContext {
      * Sets the attributes tracked by this context.
      * 
      * @param newAttributes the attributes
+     * 
+     * @return this context
      */
-    public void setIdPAttributes(@Nullable @NonnullElements final Collection<IdPAttribute> newAttributes) {
+    @Nonnull public AttributeContext setIdPAttributes(
+            @Nullable @NonnullElements final Collection<IdPAttribute> newAttributes) {
         
         if (newAttributes != null) {
             attributes = newAttributes.
@@ -78,6 +84,8 @@ public final class AttributeContext extends BaseContext {
         } else {
             attributes = Collections.emptyMap();
         }
+        
+        return this;
     }
     
     
@@ -94,8 +102,11 @@ public final class AttributeContext extends BaseContext {
      * Sets the unfiltered attributes tracked by this context.
      * 
      * @param newAttributes the attributes
+     * 
+     * @return this context
      */
-    public void setUnfilteredIdPAttributes(@Nullable @NonnullElements final Collection<IdPAttribute> newAttributes) {
+    @Nonnull public AttributeContext setUnfilteredIdPAttributes(
+            @Nullable @NonnullElements final Collection<IdPAttribute> newAttributes) {
         if (null != unfilteredAttributes) {
             unfilteredAttributes = newAttributes.
                     stream().
@@ -105,6 +116,36 @@ public final class AttributeContext extends BaseContext {
         } else {
             unfilteredAttributes = Collections.emptyMap();
         }
+        
+        return this;
     }
     
+    /**
+     * Gets whether attribute release consent was obtained from the subject during this request.
+     * 
+     * <p>This may be false if consent was obtained during a prior request, but is a signal to later
+     * actions that consent may have been obtained but not stored.</p>
+     * 
+     * @return true iff consent was obtained during this request
+     * 
+     * @since 4.2.0
+     */
+    public boolean isConsented() {
+        return consented;
+    }
+    
+    /**
+     * Sets whether attribute release consent was obtained from the subject during this request.
+     * 
+     * @param flag flag to set
+     * 
+     * @return this context
+     * 
+     * @since 4.2.0
+     */
+    @Nonnull public AttributeContext setConsented(final boolean flag) {
+        consented = flag;
+        
+        return this;
+    }
 }
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
index 887cf62da..0f1ae1028 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
@@ -149,6 +149,10 @@
     <!-- If global consent was given by user, create appropriate storage result and end flow. -->
 
     <decision-state id="TestForGlobalConsent">
+        <on-entry>
+            <!-- Note consent obtained for subsequent profile use. -->
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getSubcontext(T(net.shibboleth.idp.attribute.context.AttributeContext)).setConsented(true)" />
+        </on-entry>
         <if test="requestParameters._shib_idp_consentOptions == '_shib_idp_globalConsent'"
             then="GlobalConsent" else="ExtractConsent" />
     </decision-state>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.