Problem with deleting user consent at login

[Wessel, Keith]

I realized what changed that might be causing this: the introduction of the 2nd factor auth screen. The checkbox is on the password screen, but there's now a screen for some users between the password screen and the consent flow. If the user checks the box on the password screen but then gets sent to the Duo screen, does that decision to revoke consent decisions get stored somewhere in the session so that the consent flow will later pick it up? Or does that checkbox need to be on the last screen the user sees before the consent flow?

If it needs to be passed through the Duo screen somehow, I suspect I can add a hidden form field to the Duo template based on the checkbox from the first screen.

Of course, this theory is still just a theory.

Keith


-----Original Message-----
From: Wessel, Keith 
Sent: Monday, December 05, 2016 5:00 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Problem with deleting user consent at login

Interestingly, we received a ticket from a user about this very same issue on Friday that I was just looking into this afternoon. I've been able to reproduce the problem, and I'm sure that this checkbox worked when we rolled things out, so I can't figure out what we did to break it. We're not doing anything too non-standard with the storage: using server-cide storage with MySql and HikariCP. I'm starting to suspect that I broke the form input from that checkbox somehow; need to pull up Firebug and see what's coming through from the form.

What classes would I turn up to debug in logback.xml to see any database grumblings? I see nothing in my mysqld logs, but I also haven't turned that up to debug yet. Thought it made sense to start with what the IdP is seeing.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 05, 2016 8:14 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Problem with deleting user consent at login

On 12/5/16, 4:27 AM, "users on behalf of Krinetzki, Stephan" <users-bounces at shibboleth.net on behalf of Krinetzki at itc.rwth-aachen.de> wrote:

> I've got some problems with the user consent. If the user accepts the
> consent and then wants to review this consent, this does not work.

There has never been any functionality to review the decisions made. If the functionality we built doesn't get superseded by other work, then I'm sure we will get around to that.

> So the box at the login, which is deleting the consent, isn't working.

It works with storage options I've tested it with, so that would implicate your database as the problem. The code's not going to blow up if the delete doesn't work, so I would imagine you've got logs you're ignoring.

-- Scott
    
    
    

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net