login.vm consent revocation toggle ?

[Tom Zeller]

On Fri, Oct 24, 2014 at 9:20 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/23/14, 10:23 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>>As part of porting uApprove, the password authn view (login.vm) should
>>optionally provide a checkbox to allow users to revoke prior attribute
>>release consent. Currently the checkbox is commented out in login.vm,
>>do we want a toggle so that login.vm does not need to be modified to
>>enable consent revocation ?
>
> I would agree with Rod that it's just a needless addition when they can
> just edit the template. Note, make sure you add whatever's needed to
> login.jsp also.
>
> It seems hard to really explain to a user what that means at the time of
> login, but I guess there isn't any other place to do it apart from an out
> of band page. I think speaking for myself, I would not have an explicit
> clearing option there, but a link to a "My Privacy Settings" page that had
> the control.
>
>>The object which holds the configuration which controls whether
>>consent is enabled is the AttributeReleaseFlowDescriptor, so the login
>>view would need to call the accessor method of the flow descriptor for
>>the toggle. The flow descriptor would be looked up via a lookup
>>strategy. We would also need to check to see if the
>>"attribute-release" flow is enabled via the property in
>>idp.properties.
>>
>>Not sure if we want all that running every login or not.
>
> That's why I'm thinking having a separate page makes that simpler, if it's
> the other page that has to do that work.

Getting back to consent revocation ... the suggestion I'm hearing is
to have a link to a page which controls consent revocation rather than
a checkbox on the login page. I guess that means the "manage consent"
flow would need to authenticate the user and resolve attributes
without any particular relying party, if the user is not already
authenticated. Does that make sense ... is there an existing flow that
authenticates a user "to the idp" ?