manage (view, revoke) consent in IDP

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-05-25 19:34]:
> Originally, we ran this question of a UI by SWITCH, since they were
> the major push behind us doing the implementation and they agreed we
> could defer it at the time. There hasn't been any specific
> discussion about it since the 3.0 release.

Thanks for sharing those background discussions.  I can easily agree
that it's not a top priority to have such a UI, as I doubt the
majority of people who would be the inteded audience for its use will
even care.  I just felt it would make the whole consent thing (and
explanation of the UI, what happens when you chose this vs. something
else, how to change your mind, etc.) more viable and the UI more
simple if you could easily revisit your decisions any time in a kind
of overview.

Since revoking currently only ever works for the first SP accessed in
a new SSO session (somewhat of a legal issue, when the requirement for
consent under GDPR is that it needs to be as easy to revoke it as to
give it) I felt there must be a better way of doing things, given that
the IDP necessarily has the data already available and is making use
of it. Showing those records and selectively nuking some of those
records didn't seem such an outlandish idea, then.

I can certainly ask on the consortium members list how other members
feel about this (though this will have to wait a week or two).

Cheers,
-peter