intercept/attribute-release flow with attribute queries in v3

[Kaspar Brand]

Meanwhile I've started playing with the postAuthenticationFlows in beta
1, in particular intercept/attribute-release. Was mostly working as
expected, a minor issue first: the DOCTYPE declaration was dropped with
beta 1 [1], which leads to unintended font sizing effects (size of
attribute names and values too large, at least in Firefox), due the
browser falling back to quirks mode. Re-adding a suitable DOCTYPE line
(xhtml1-transitional, or xhtml1-strict perhaps) fixes the issue.

The second thing I observed is that the rightmost column on the
attribute release page, which allows selecting/deselecting the
to-be-released attributes, is working fine as long as it is used with an
SSO profile with includeAttributeStatement="true" - but it doesn't
really do what I would expect when the attributes are only retrieved via
a subsequent backchannel query (i.e. when
includeAttributeStatement="false"). In this case, all attributes are
released, irrespective of what the user has selected/deselected on the
user consent page. AFAICT, the attribute-release intercept flow is
currently not meant to used with attribute queries, is that correct? Is
this something which could be added for v3, or am I just trying to
configure a setting which isn't intended to be supported?

Kaspar

[1]
http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/views/intercept/attribute-release.vm?r1=6985&r2=6989