idp.consent.userStorageKeyAttribute attribute not available when consent flow runs

[Etienne Dysli-Metref]

Hello,

I'm seeing the line below in the logs when a consent flow runs (either
terms of use or attribute release):

DEBUG [net.shibboleth.idp.consent.logic.AttributeValueLookupFunction:93]
- Attribute 'swissEduPersonUniqueID.withoutAttributeEncoder' does not
exist or has no values

even though that attribute produced one value when resolved. Then the
generated key contains only the SP's entityID and this causes consent
decisions to ignore the user being authenticated (e.g. the first user to
ever log in on the IdP gets the ToU prompt then nobody else gets it, for
a given SP).

The attribute configured here
"swissEduPersonUniqueID.withoutAttributeEncoder" is an encoder-less
version of the swissEduPersonUniqueID so it won't be released. Now the
questions: must the attribute used by consent flow storage
(idp.consent.userStorageKeyAttribute property) be 1) encoded 2) released
by filtering? or is it subject to other prerequisites in order to be
available in consent flows?

Cheers,
  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20150707/2f9a40e6/attachment.sig>