login.vm consent revocation toggle ?

[Cantor, Scott]

On 11/12/14, 3:32 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>Getting back to consent revocation ... the suggestion I'm hearing is
>to have a link to a page which controls consent revocation rather than
>a checkbox on the login page.

Eventual suggestion, but I don't think we need it for ship. That was what 
I had planned for next year under the heading of polishing up this work.

> I guess that means the "manage consent"
>flow would need to authenticate the user and resolve attributes
>without any particular relying party, if the user is not already
>authenticated. Does that make sense ... is there an existing flow that
>authenticates a user "to the idp" ?

Not yet, but it's intended that we can get this to work by reusing the 
authentication subflow that we have. It's probably not all there yet but I 
have thought about it.

Brent mentioned on one of the calls that we'd like to be able to do this 
for a lot of the admin stuff too. Right now, there's a primitive access 
control model in place of course, but I do want to eventually put the full 
login flow in front of it.

Another take on this is to tie it into the idea of building a minimal SP 
into the code for gateway use, and you could think of it as the IdP being 
the SP in this case, it's one identity. In SAML terms, that works fine.

Basically, it's not there yet, but we have the right pieces now to do it.

-- Scott