login.vm consent revocation toggle ?

[Cantor, Scott]

On 10/23/14, 10:23 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>As part of porting uApprove, the password authn view (login.vm) should
>optionally provide a checkbox to allow users to revoke prior attribute
>release consent. Currently the checkbox is commented out in login.vm,
>do we want a toggle so that login.vm does not need to be modified to
>enable consent revocation ?

I would agree with Rod that it's just a needless addition when they can
just edit the template. Note, make sure you add whatever's needed to
login.jsp also.

It seems hard to really explain to a user what that means at the time of
login, but I guess there isn't any other place to do it apart from an out
of band page. I think speaking for myself, I would not have an explicit
clearing option there, but a link to a "My Privacy Settings" page that had
the control.

>The object which holds the configuration which controls whether
>consent is enabled is the AttributeReleaseFlowDescriptor, so the login
>view would need to call the accessor method of the flow descriptor for
>the toggle. The flow descriptor would be looked up via a lookup
>strategy. We would also need to check to see if the
>"attribute-release" flow is enabled via the property in
>idp.properties.
>
>Not sure if we want all that running every login or not.

That's why I'm thinking having a separate page makes that simpler, if it's
the other page that has to do that work.

-- Scott