[java-identity-provider] 03/03: IDP-1920 - Attribute release activation condition is SAML-specific

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=138e89f536ad9ced92094027302714e914203df9

commit 138e89f536ad9ced92094027302714e914203df9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 14 12:47:33 2022 -0400

    IDP-1920 - Attribute release activation condition is SAML-specific
    
    https://shibboleth.atlassian.net/browse/IDP-1920
    
    Removed the extra condition logic.
---
 .../idp/conf/profile-intercept-system.xml          | 25 +++-------------------
 .../conf/intercept/consent-intercept-config.xml    |  3 ++-
 2 files changed, 5 insertions(+), 23 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
index 5d6d39b8c..df5e8764c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
@@ -58,29 +58,10 @@
             p:maximumNumberOfStoredRecords="%{idp.consent.maxStoredRecords:10}"
             p:expandedNumberOfStoredRecords="%{idp.consent.expandedMaxStoredRecords:0}"
             p:expandedStorageThreshold="%{idp.consent.expandedStorageThreshold:1048576}"
-            p:nonBrowserSupported="false">
-        <property name="activationCondition">
-            <bean parent="shibboleth.Conditions.AND">
-                <constructor-arg>
-                    <ref bean="#{'%{idp.consent.attribute-release.activationCondition:shibboleth.Conditions.TRUE}'.trim()}" />
-                </constructor-arg>
-                <constructor-arg>
-                    <bean parent="shibboleth.Conditions.OR">
-                        <constructor-arg>
-                            <bean parent="shibboleth.Conditions.NOT">
-                                <constructor-arg value="%{idp.consent.allowPerAttribute:false}" />
-                            </bean>
-                        </constructor-arg>
-                        <constructor-arg>
-                            <bean class="net.shibboleth.idp.saml.profile.config.logic.IncludeAttributeStatementPredicate" />
-                        </constructor-arg>
-                    </bean>
-                </constructor-arg>
-            </bean>
-        </property>
-    </bean>
+            p:nonBrowserSupported="false"
+            p:activationCondition-ref="#{'%{idp.consent.attribute-release.activationCondition:shibboleth.Conditions.TRUE}'.trim()}" />
 
-    <!-- Attribute release flow for attribute queries -->
+    <!-- Attribute release flow for attribute queries or related back-channel profiles. -->
     <bean p:id="intercept/attribute-release-query" parent="shibboleth.consent.AttributeReleaseFlow" />
 
     <!-- Parent bean for terms of use consent flows. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
index a76d5809f..1d5ecd7b0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
@@ -86,7 +86,8 @@
     </bean>
 
     <!--
-    Condition to evaluate to apply attribute-release consent to attribute queries.
+    Condition to evaluate to apply attribute-release consent check to attribute queries, CAS validation,
+    or other back-channel profiles. Generally should be enabled if the attribute-release feature is enabled.
     -->
     <bean id="shibboleth.consent.AttributeQuery.Condition" parent="shibboleth.Conditions.FALSE" />
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.