external authentication -> revoke consent

[Tom Zeller]

> svn diff -r 7587:head idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExternalAuthenticationImpl.java
> seems to indicate, that before 7587 response.sendRedirect() was done always(?)
> 
>         attr = request.getAttribute(REVOKECONSENT_KEY);
>         if (attr != null && attr instanceof Boolean && ((Boolean) attr).booleanValue()) {
> -            response.sendRedirect(extContext.getFlowExecutionUrl()
> -                    + "&" + ProfileInterceptorFlowDescriptor.REVOKE_CONSENT_PARAM + "=1");
> +            final ConsentManagementContext consentCtx =
> + getProfileRequestContext(request).getSubcontext(ConsentManagementContext.class, true);
> +            consentCtx.setRevokeConsent(true);
>         } else {
>             response.sendRedirect(extContext.getFlowExecutionUrl());
>         }

Scott would have to say for sure, but I think not redirecting back to Web Flow from an external authn Servlet when consent is revoked is a bug.