Consent / upgrades

[Eric Goodman]

>Sure, but I'm not saying you couldn't turn it off with a switch, I'm just 
>wondering what the default should be with an eye on the community as a whole 
>given that unfortunately or not most places just run a lot of very vanilla 
>stuff without much regard for why.

-- Scott

If I'm reading your comment correctly you want to both:

1) Put enough schema in place to allow trivially enabling consent when an installer wants to do so and
2) To actually enable the consent flow after doing this.

Without knowing how much effort is required to do the schema changes after upgrade, #1 seems to be a good idea. Perhaps even an installer option to enable the consent flow would make sense. But I think that for those paying attention, they wouldn't want such a substantive change turned on by default, for the reasons Dave calls out. 

However you choose to do it, I think there should be an easy way to deploy the upgrade without enabling consent. If you do enable it by default, I think the installer needs to loudly proclaim what it's doing and how to disable it. That is, not some hidden "read me", but an in-your-face "we are enabling this thing, here's how to simply disable it" message. (You could also point at how to customize it as well.)

I understand the value of having consent and the desire to deploy it, however: (1) Adding a consent screen does not change attribute release rules, so to get better release, IdP operators still need to make actual changes. (2) Adding a consent screen will likely increase Help Desk calls significantly, and may impact uninformed people getting into existing apps (that would be "whitelisted" in a planned deployment). (3) While I know you're intentionally looking to do this, having the software deployer decide "we know better than you, this is a better way to do this" is somewhat questionable to me.

Of course, that (#3) is exactly the Google model and Universities are adapting to it, so other than being heavy-handed it may not be a huge deal. I think the first two are the reasons it makes sense not to "silently" enable consent.

--- Eric