> Should not the deletion of the consent be mentioned here? The attribute-release intercept flow has a RevokeConsent action which attempts to delete the consent storage records. If you are logging net.shibboleth.idp.consent at DEBUG, you should see the attempt and success/failure. Tom