AW: NameID from Subject

[Lukas Hämmerle]

On 07.08.14 16:17, Ortner Nikolaus wrote:
>> And this way the concept of "consent" (or its withdrawal?) becomes 
>> meaningless.
> 
> Not if the user could bail "remove me from this SP" or "have me
> removed from any SP that asks later" at his IdP. And the back channel
> should have some mechanism to signal this to the SP (maybe also
> automatically when a certain identity gets inactive/deleted).

In this particular case, it would be much easier if the user somehow
could tell the IdP, "please delete my persistentId for that SP". This
way, the SP could not make attribute queries anymore.

Best Regards
Lukas


-- 
SWITCH
Lukas Hämmerle, Central Solutions
GÉANT Project Task Leader "Enabling Users"
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch