Attribute consent display logic is still confusing

[Tom Zeller]

> On Nov 26, 2015, at 4:27 AM, Etienne Dysli-Metref <etienne.dysli-metref at switch.ch> wrote:
> 
> I find the logic that decides whether an attribute is displayed on the
> consent screen confusing. I mean the code of
> net.shibboleth.idp.consent.logic.impl.AttributePredicate [1], not the
> documentation in the wiki [2] (yet).
> 
> I want to have a whitelist of attributes to always show on the attribute
> consent screen with a specific order (from most personal to least). I
> also want to have a blacklist to hide cryptic identifiers. Finally, I
> want to have a catch-all safety regular expression so that any attribute
> I forget to put in the white or black lists is displayed.
> 
> To achieve this with the current code, I have to put the attributes I
> want to hide both in the blacklist AND in the whitelist (because
> attributes NOT in the whitelist are only checked against the match
> expression and my regex matches everything). That conflicts with my idea
> of a blacklist [3], weird.
> 
> Is there a way to configure attribute consent in order to achieve my
> goal above that doesn't induce cognitive dissonance? ;) Perhaps the
> relationship/priority between the blacklist and the match expression
> needs to be rethought...

Now that I see it, that’s a bug.

https://issues.shibboleth.net/jira/browse/IDP-873