Bypass attribute release consent for some SPs

[Cantor, Scott]

On 10/28/15, 1:39 PM, "users on behalf of Simone Avogadro" <users-bounces at shibboleth.net on behalf of simone.avogadro at gmail.com> wrote:



>Hi everyone,
>   at a quick glance I don't seem to find a way to enable attribute release consent only for some SPs.
>  Namely we have 2 different metadata provider:
> - external: we want the attribute release to be shown
> - internal: the user already gave us a broad consent and we don't want to show any more requests

You can't base it on metadata source directly. You can use EntitiesDescriptor Name as the basis of a group-based predicate or you can do something more general with EntityAttributes in the metadata, which is known as a tag-based predicate. That would require adding a MetadataFilter to the metadata providers that attaches a custom EntityAttribute to each entity when the metadata is loaded. Groups are much simpler, but much less general and highly dependent on control of the metadata sources.

Either way, the most common places to apply the condition are in a RelyingParty override that enables or disables the specific intercept to run or by attaching it as an activationCondition to the intercept flow descriptor bean for the attribute consent flow. The descriptors are in intercept/profile-intercept.xml

>   I guess this is a pretty common scenario but I missed the setting to configure this. Anyone so kind to provide some pointers to speedup the process?

There are examples on RelyingParty overrides and ActivationConditions in the wiki.

-- Scott