Adding an activation condition to an intercept flow ?

[Takeshi Nishimura]

> > Even after attributes are pushed, the SP can obtain attributes through
> > Attribute Query interface. Right?
> 
> If it has a subject it can query on. That's entirely up to the IdP, as is 
> offering a query in the first place.

I assume transient ID.

> > If the latter attributes are different from the former with per-attribute
> > consent, it may be unexpected behavior of IdP.
> 
> I don't consider that unexpected.

Assuming there are attribute A and B, and a user allows only A to be sent.
Of course, only attribute A is pushed. But attributes obtained through Attribute Query are A and B.
That is, attribute B can be sent without the user's consent.

Best regards,
Takeshi