Consent with CAS

[Marvin Addison]

I'm doing recon for getting the CAS flows updated to support the consent
work, and there's an immediate obstacle: the AttributeContext needed as a
precondition is not available in the CAS login flow. It's not there since
it's not needed; attributes are resolved on the back channel ticket
validation step that follows login. It's straightforward to add an optional
attribute resolution step in the login flow to support the consent flows,
but I'm curious whether that will work in any or all cases. The fundamental
problem is that the conversation where attributes are approved (login) is
distinct from the conversation where user preferences are applied (ticket
validation). I see there's a previousConsents attribute on ConsentContext
that is populated from persistent storage, which afaict is what I'll need
to rely on to get this to work. Unfortunately, the Web storage facility
will not be available on the back-channel step, so even if the consent data
is persisted successfully, I won't be able to get to it when I need it. Can
I get around that by requiring a server-side consent store like JPA or
memcached? Is that supported yet?

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150615/f2cd793a/attachment.html>