Adding an activation condition to an intercept flow ?

[Cantor, Scott]

> > If it has a subject it can query on. That's entirely up to the IdP, as is
> > offering a query in the first place.
> 
> I assume transient ID.

Right, so one issue is just the whole clustering thing, but even that aside, there's no requirement to offer the capability to reverse map them. Just saying this is all entirely under the deployer's control to allow it, and right now consent is very much not compatible with offering queries, at least not when the RPs overlap.

To get that fixed, we will need to produce an API to expose user consent policy.

> Assuming there are attribute A and B, and a user allows only A to be sent.
> Of course, only attribute A is pushed. But attributes obtained through
> Attribute Query are A and B.
> That is, attribute B can be sent without the user's consent.

Yes, but that is not unexpected to me.

-- Scott