Default RP config for SAML 1 and attribute-release ?

[Cantor, Scott]

On 12/21/14, 4:20 AM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>
>Working on integration tests, and I'm confused. The attribute-release
>flow is enabled for SAML 1, but not includeAttributeStatement, which
>seems like a conflict, because no attributes are actually released,
>but the user is prompted.
>
>So, should the default RP config have :
>
> <bean parent="Shibboleth.SSO" p:includeAttributeStatement="true"
>p:postAuthenticationFlows="attribute-release" />
>
>instead of
>
> <bean parent="Shibboleth.SSO"  
>p:postAuthenticationFlows="attribute-release" />

No, I configured the intercept to match uApprove's behavior, so it still 
activates as long as per-attribute consent is turned off. Their logic is 
that transient identifiers don't nominally permit queries except after 
SSO, and the only NameIDs supported by default are transients.

-- Scott