intercept/attribute-release flow with attribute queries in v3

[Cantor, Scott]

On 12/17/14, 10:54 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:


>
>Certainly applying the permissions to attribute queries would make it 
>hard to inform the user what was wrong in real time at the SP. Does SAML 
>have a standard way to send a specific, potentially user-facing error 
>message in a failure response?

Yes, but not interoperably. In practice, outside our community, SAML is 
used for strictly rigid, very well-defined B2B scenarios where attribute 
flow is simply regulated out of band. Just doesn't come up.

> (and is failure even the right response if only some attributes were 
>barred from release by consent)

Not really. Unless the IdP knew what the SP's access policy is/was, it has 
very little to go on.

Every time we try and avoid the fact that error handling belongs at the 
SP, we get into trouble, IMHO.

For the time being, I implemented a condition that disables the flow by 
default if attributes aren't pushed and the per-attribute consent option 
is on. That doesn't do what the Gakunin fork did, but it maintains the 
behavior of uApprove now without introducing questionable behavior if the 
new options are used.

The follow-on releases will honor the consent state during queries if 
there is a server side store, and after that, it really just depends 
whether there's demand for a full-blown UI to manage policies for the user 
vs. a simpler UI to just review and revoke past consent decisions. The 
former's much more work, while the latter is definitely needed.

-- Scott