v3 consent to attribute release : model terms-of-use as attribute ?

[Cantor, Scott]

On 9/30/14, 1:36 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>We've talked about terms-of-use as a special case of the consent flow,
>and I think you suggested that the text of the terms-of-use would be
>modeled as an attribute from attribute-resolver.xml, did I get that
>right ?

I don't think I necessarily suggested that, although it's not impossible
to do that. I was assuming we'd use a configured token of some sort that
would be mapped into the text through the MessageSource interface, much
like the error events. My thinking was that the token itself would be
thing we'd record rather than hashing the message, since that way the
token itself is your versioning tool and you can adjust wording and such
without worrying about invalidating decisions.

> If so, I'm wondering how to handle that attribute specially
>during attribute resolution so it is available to the consent flow but
>not actually released.

As an independent question, the answer to that is that you could do a
couple of things. One is that you could include it during standard
resolution, but just not attach any SAML encoders to it, which means it
doesn't matter whether it's formally "released" or not, it would never
show up outside.

Alternatively, it's a simple matter to run a dedicated attribute
resolution step for a specific attribute (I've done that in some of the
flows) and just ignore filtering. Basically you end up with an
AttributeContext in some dedicated spot that isn't used to actually
generate attributes in the assertion.

-- Scott