Default RP config for SAML 1 and attribute-release ?

[Tom Zeller]

> On Dec 21, 2014, at 12:02 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
>> On 12/21/14, 4:20 AM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>> 
>> 
>> Working on integration tests, and I'm confused. The attribute-release
>> flow is enabled for SAML 1, but not includeAttributeStatement, which
>> seems like a conflict, because no attributes are actually released,
>> but the user is prompted.
>> 
>> So, should the default RP config have :
>> 
>> <bean parent="Shibboleth.SSO" p:includeAttributeStatement="true"
>> p:postAuthenticationFlows="attribute-release" />
>> 
>> instead of
>> 
>> <bean parent="Shibboleth.SSO"  
>> p:postAuthenticationFlows="attribute-release" />
> 
> No, I configured the intercept to match uApprove's behavior, so it still 
> activates as long as per-attribute consent is turned off. Their logic is 
> that transient identifiers don't nominally permit queries except after 
> SSO, and the only NameIDs supported by default are transients.

Gosh, I don't think attribute-release is wired into the attribute query flow in v3, or did you do that ? Or maybe I'm confused.

(mobile)