Consent Logging

[Tom Zeller]

> I've been playing with the existing log entries to get some statistics on behavior with the Shibboleth consent page. I get entries where the user has accepted the release of attributes, but I don't think the IdP logs when they click on deny. Is there a way to log those as well? I understand that we'll probably just be missing the behavior where someone just closes the screen instead of hitting deny.

It should be logged. Looking at views/intercept/attribute-release.vm, the button to deny is named “_eventId_AttributeReleaseRejected”. The AttributeReleaseRejected event is mapped to a local error in conf/errors.xml :

    <!--
    Map of events to trap and handle with local views, without returning to SPs.
    The map values are flags indicating whether to write an audit log record.
    -->
    <util:map id="shibboleth.LocalEventMap">
	...
        <entry key="AttributeReleaseRejected" value="true" />
	...
    </util:map>

So, if it’s not logged, that’s a bug.

> Also there are two different types of records that show up. but I'm not understanding the difference between:
> AttributeReleaseConsent
> GlobalAttributeReleaseConsent

“Global” means “release everything to anyone”, i.e. “don’t ask me anymore”.