AW: Problem with deleting user consent at login

[Krinetzki, Stephan]

>>  I realized what changed that might be causing this: the 
>> introduction of the 2nd factor auth screen. The checkbox is on the 
>> password screen, but there's now a screen for some users between the 
>> password screen and the consent flow. If the user checks the box on 
>> the password screen but then gets sent to the Duo screen, does that
decision to revoke consent decisions get stored somewhere in the session so
that the consent flow will later pick it up? Or does that checkbox need to
be on the last screen the user sees before the consent flow?

>It used to be a query parameter but it was changed so that it (eventually)
puts something into the context tree to track the request.

>I don't recall offhand where that step happens and it's plausible that the
Duo screen is the cause of the change and there's a bug. I would have
thought it got recorded before the password flow exists though.

>-- Scott

So it's maybe an bug? I didn't find anything in my log, only that the SP
session is saved to the database, but no deletion of the consent record:

2016-12-06 10:14:41,591 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:1
24] - IP:134.61.116.40 | Configuration specifies the following formats: []
2016-12-06 10:14:41,591 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:1
34] - IP:134.61.116.40 | No formats specified in configuration or in
metadata, returning default
2016-12-06 10:14:41,593 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAsse
rtion:592] - IP:134.61.116.40 | Found Assertion with AuthnStatement to
decorate in outbound Response
2016-12-06 10:14:41,593 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAsse
rtion:290] - IP:134.61.116.40 | Issuance of delegated was not indicated,
skipping assertion decoration
2016-12-06 10:14:41,594 - DEBUG
[net.shibboleth.idp.session.impl.UpdateSessionWithSPSession:156] -
IP:134.61.116.40 | Profile Action UpdateSessionWithSPSession: Adding new
SPSession for relying party
https://webapp.rz.rwth-aachen.de/selfservice/shibboleth2 to existing session
99e19fa6af1985c03209187c984f7f6d73eac85272761ec3af8c203e2c85daaf
2016-12-06 10:14:41,594 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:664] -
IP:134.61.116.40 | Saving SPSession for service
https://xxxxxxxxxx/xxxxxxxxxx/shibboleth2 in session
99e19fa6af1985c03209187c984f7f6d73eac85272761ec3af8c203e2c85daaf
2016-12-06 10:14:41,595 - DEBUG
[net.shibboleth.idp.session.SPSessionSerializerRegistry:86] -
IP:134.61.116.40 | Registry located StorageSerializer of type
'net.shibboleth.idp.saml.session.impl.SAML2SPSessionSerializer' for
SPSession type 'class net.shibboleth.idp.saml.session.SAML2SPSession'
2016-12-06 10:14:41,597 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:646] -
IP:134.61.116.40 | Maintaining secondary index for service ID https://
xxxxxxxxxx/xxxxxxxxxx/shibboleth2 and key
AAdzZWNyZXQxBMYLGBAReCcIWjng6mmdBeS0rAjbkMg4onCu6Av1+Oq+z3dee3gPWCVJFmdgEESY
+LN/H6/cpQheMk7PWvzBZT91ZOrdG/0bdxTrn7PkaVd1wPmWeNUK1DDtiRRr4LYE39JJCDPUxEcB
brJzsjzXc9F98jEQbfUcfqoNhK/D
2016-12-06 10:14:41,602 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] -
IP:134.61.116.40 | Profile Action WebFlowMessageHandlerAdaptor: Invoking
message handler of type
'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND
message context
2016-12-06 10:14:41,602 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
IP:134.61.116.40 | Profile Action WebFlowMessageHandlerAdaptor: Invoking
message handler on message context containing a message of type
'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2016-12-06 10:14:41,621 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- IP:134.61.116.40 | Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2016-12-06 10:14:41,623 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] -
IP:134.61.116.40 | Profile Action RecordResponseComplete: Record response
complete

Should not the deletion of the consent be mentioned here?

Greetings
Stephan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5849 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20161206/23fd74c4/attachment-0001.p7s>