v3 consent to attribute release : required vs optional attrs ?

[Cantor, Scott]

On 8/20/14, 8:17 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>I have not done my homework, but does metadata provide whether or not
>a requested attribute is required or optional ?

Yes. It's not a common feature because it doesn't work if your GUI doesn't
support per-attribute control, and the most pervasive UI is uApprove,
which doesn't. If your GUI does, then it works fine, provided the
attribute you're requiring is not one that is from a set of possible
attributes, any of which might satisfy. Attributes like displayName tend
to have that problem, as do identifiers/usernames. In other words, there's
no boolean syntax. That's XACML, which nobody is going to accept the
complexity of.

>More to the point, if an attribute is required by a requester, should
>the user still be allowed to exclude it ?

I would think not, but ultimately the point of a designation in metadata
is not "you MUST do X" but "if you don't do X, don't call me when it
crashes".

But I think it's bad form to give users choices that end up creating
failure. If they really don't want to permit it, they should just
terminate the request.

BTW, as I've continued to work through and refine the error handling, it's
clear that the result of "declining" consent should be an Event, not any
presumption of a specific end result by us. The IdP engine now can take
any Event you signal and turn it into any SAML response status or local
error page/text the deployer wants.

> I would think so, but with a
>caveat that things might not work properly, I guess. Maybe this is
>another configuration toggle.
>
>Probably out-of-scope at the moment, but I'm trying to wrap my head
>around the flow.

Sure.

-- Scott