NameID from Subject

[Peter Schober]

* Lukas Hämmerle <lukas.haemmerle at switch.ch> [2014-08-07 15:33]:
> uApprove does not interfere during a SAML attribute query. So, the
> attributes will be released if they have changed or not. This is indeed
> a bit problematic because a user could revoke his consent for a
> particular SP but that SP then still could make attribute queries to get
> that user's attribute.
> 
> On the other hand, because the user must have at least once accessed the
> SP, that SP already got all the user's attributes. Also, one of the
> purposes of making attribute queries is exactly to get up-to-date user
> information. If uApprove would block this because the user has not given
> consent yet, this whole feature would become obsolete.

And this way the concept of "consent" (or its withdrawal?) becomes
meaningless. 

Rock > uApprove < a hard place.

-peter