NameID from Subject

[Peter Schober]

* Ortner Nikolaus <N.Ortner at fh-kaernten.at> [2014-08-07 16:18]:
> > And this way the concept of "consent" (or its withdrawal?) becomes
> > meaningless.
> 
> Not if the user could bail "remove me from this SP" or "have me
> removed from any SP that asks later" at his IdP.
> And the back channel should have some mechanism to signal this to
> the SP (maybe also automatically when a certain identity gets
> inactive/deleted).

I didn't make any new claims or statements, I was mostly rephrasing
Lukas': You can decide to ignore revoked consent (because otherwise
"this whole feature would become obsolete") but that is making consent
(or its withdrawal in) UIs meaningless, of course.
That's a decision you can make. How bad that is probably depends on
how much you've tied uApprove consent to the legal concept of consent
as it exists in e.g. 95/46/EC and national implementations thereof.
(I.e., if clicking in uApprove is the only reason a given transfer of
data can be seen as legal, you're in trouble with the cited attitide
to revoked consent. If it's not, then it's probably not "consent" in
the first place, but information to the user. Which is almost as good,
many feel, and there's nothing to revoke.)

I won't get into the "should have" discussion. :)
Feel free so suggest new features in the issue tracker, keeping in
mind the number of SAML implementations (and IDP/AA deployments) that
support attribute queries in the first place.
-peter