Problem with deleting user consent at login

[Cantor, Scott]

On 12/5/16, 6:18 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    I realized what changed that might be causing this: the introduction of the 2nd factor auth screen. The checkbox is on
> the password screen, but there's now a screen for some users between the password screen and the consent flow. If the
> user checks the box on the password screen but then gets sent to the Duo screen, does that decision to revoke consent
> decisions get stored somewhere in the session so that the consent flow will later pick it up? Or does that checkbox need to
> be on the last screen the user sees before the consent flow?

It used to be a query parameter but it was changed so that it (eventually) puts something into the context tree to track the request.

I don't recall offhand where that step happens and it's plausible that the Duo screen is the cause of the change and there's a bug. I would have thought it got recorded before the password flow exists though.

-- Scott