Guidance on IDP-465, attribute-query consent ?

[Cantor, Scott]

On 8/30/18, 8:37 AM, "dev on behalf of Tom Zeller" <dev-bounces at shibboleth.net on behalf of tzeller at dragonacea.biz> wrote:

> When you have a chance, guidance / confirmation on how to implement
> IDP-465 / SUPPORT-56 would be helpful.

Add an action to lookup the relevant storage records and filter down the intermediate attribute set.

> In order to apply consent (attribute-release) to attribute queries, I
> assume we want to add the ability to call profile interceptors to the
> attribute query flow.

No, just a simple property to enable it to enforce consent on queries should be good enough. Some people won't even want that to happen, so it would need to be toggleable anyway.

> Do you think the attribute-release flow should be adapted to
> non-browser profiles, or should a new flow be created ?

Neither, I think it's one or two beans at most wired into the existing flows.

> I hacked together a PoC by creating a new flow, and the main issue I
> encountered was needing to adjust the storage context key (by default
> it's the flow ID).

There should be some kind of API built to expose the storage records however they're currently being built, though it may not yet have to be a public API at this point.

-- Scott