[java-identity-provider] branch main updated: Revoke consent using cookie

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e104a85dca1b5437e85fc766836db72ffb3e165e

The following commit(s) were added to refs/heads/main by this push:
     new e104a85dc Revoke consent using cookie
e104a85dc is described below

commit e104a85dca1b5437e85fc766836db72ffb3e165e
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Wed Dec 13 16:08:41 2023 -0600

    Revoke consent using cookie
    
    https://shibboleth.atlassian.net/browse/IDP-2175
---
 .../flows/intercept/attribute-release-beans.xml    |  7 +++++++
 .../idp/flows/intercept/attribute-release-flow.xml | 23 ++++++++++++++++++++--
 .../net/shibboleth/idp/module/views/user-prefs.js  |  4 ++--
 .../net/shibboleth/idp/module/views/user-prefs.vm  |  4 +++-
 4 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
index 855968df7..59e423eb4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
@@ -97,6 +97,13 @@
         class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext.FormattingMapParser"
         c:_0="#{getObject('shibboleth.consent.attribute-release.AuditFormattingMap') ?: getObject('DefaultAuditFormattingMap')}" />
 
+    <!-- Name of cookie to revoke consent. -->
+    <bean id="shibboleth.consent.RevokeConsentCookieName" class="java.lang.String" c:_0="_shib_idp_revokeConsent" />
+
+    <!-- Simplifies flow definition expressions to revoke consent. -->
+    <alias name="shibboleth.consent.RevokeConsentCookieName" alias="RevokeConsentCookieName" />
+    <alias name="shibboleth.UserPrefsCookieManager" alias="RevokeConsentCookieManager" />
+
     <!-- Action beans -->
 
     <bean id="InitializeConsentContext"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
index 262e8e9a9..dbe161d86 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-flow.xml
@@ -29,6 +29,13 @@
 
     <decision-state id="TestForRevokeConsent">
         <if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.consent.context.ConsentManagementContext)).getRevokeConsent()"
+            then="RevokeConsent" else="TestForRevokeConsentCookie" />
+    </decision-state>
+
+    <!-- If consent revocation was requested via cookie, revoke, otherwise read from storage. -->
+
+    <decision-state id="TestForRevokeConsentCookie">
+       <if test="RevokeConsentCookieManager.getCookieValue(RevokeConsentCookieName, null) != null"
             then="RevokeConsent" else="ReadConsentFromStorage" />
     </decision-state>
 
@@ -51,14 +58,26 @@
 
     <decision-state id="TestForRevokeGlobalAttributeConsent">
         <if test="attributeReleaseFlowDescriptor.isGlobalConsentAllowed()"
-            then="RevokeGlobalAttributeConsent" else="PopulateConsentContext" />
+            then="RevokeGlobalAttributeConsent" else="ShouldUnsetCookie" />
     </decision-state>
 
     <action-state id="RevokeGlobalAttributeConsent">
         <evaluate expression="RevokeGlobalAttributeConsent" />
         <evaluate expression="'proceed'" />
         
-        <transition on="proceed" to="PopulateConsentContext" />
+        <transition on="proceed" to="ShouldUnsetCookie" />
+    </action-state>
+
+   <!-- Remove revoke consent cookie if it exists. -->
+
+    <decision-state id="ShouldUnsetCookie">
+        <if test="RevokeConsentCookieManager.getCookieValue(RevokeConsentCookieName, null) != null"
+            then="UnsetCookie" else="PopulateConsentContext" />
+    </decision-state> 
+
+    <action-state id="UnsetCookie">
+        <evaluate expression="RevokeConsentCookieManager.unsetCookie(RevokeConsentCookieName)" />
+        <transition to="PopulateConsentContext" />
     </action-state>
 
     <!-- Read consent from storage. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
index fcb900379..2adc3b007 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
@@ -31,8 +31,8 @@ function readCookie(name) {
 function load(id) {
     var checkbox = document.getElementById(id);
     if (checkbox != null) {
-        var spnego = readCookie(checkbox.name);
-        checkbox.checked = (spnego == "1");
+        var value = readCookie(checkbox.name);
+        checkbox.checked = (value == "1");
     }
 }
 
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
index 3915d18c4..bf22fffb4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
@@ -10,7 +10,7 @@
 ## cspDigester - Calculates base64-encoded SHA-2 hashes (call apply)
 ## cspNonce - Calculates secure nonces (call generateIdentifier)
 ##
-#set ($onLoad = "load('spnego')")
+#set ($onLoad = "load('spnego');load('revokeConsent')")
 #set ($onClick = "check(this)")
 $response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)' 'sha256-$cspDigester.apply($onClick)'")
 #set ($nonce = $cspNonce.generateIdentifier())
@@ -47,6 +47,8 @@ $response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
                     <p>#springMessageText("idp.userprefs.options", "The following options are available:")</p>
                     <input type="checkbox" id="spnego" name="_idp_spnego_autologin" value="1" onClick="$onClick">
                     <label for="spnego"> #springMessageText("idp.userprefs.spnego", "Automatically try desktop login when available.")</label>
+                    <input type="checkbox" id="revokeConsent" name="_shib_idp_revokeConsent" value="1" onClick="$onClick">
+                    <label for="revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
                 </form>
             </section>
             

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.