Default RP config for SAML 1 and attribute-release ?

[Cantor, Scott]

On 12/21/14, 9:05 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>Gosh, I don't think attribute-release is wired into the attribute query 
>flow in v3, or did you do that ? Or maybe I'm confused.

It's not.

If you can't selectively turn off attributes, then the set of attributes 
being consented to is the same set that a query will return if it's done 
in the span of a minute.

If you can only perform a query with a transient ID, then you can only 
query immediately after SSO.

Put the two together and by default, it's not unreasonable to "consent" on 
the front channel to the attributes that will be released on the back 
channel.

Break either of the assumptions and it stops making sense.

-- Scott