Attribute Consent -- Restrict by entityId

[Joel Levin]

Hi:

Based on testing -- When the " p:postAuthenticationFlows="attribute-release"
is commented out in the DefaultRelyingParty -- the IdP rejects integrations
unless it is explicitely listed in RelyingPartyByName.

Am I doing something incorrectly?

We would like a small subset of integrations to be presented with the
'attribute consent' form -- majority would not require it - does it mean
that we would have to explicitly list every SP in RelyingPartyByName
(whether 'consent form' required or not)?


<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <!-- <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release"
/> -->
                <!-- <ref bean="SAML2.ECP" /> -->
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <!-- <ref bean="Liberty.SSOS" /> -->
            </list>
        </property>
    </bean>

    <!-- Container for any overrides you want to add. -->

    <util:list id="shibboleth.RelyingPartyOverrides">



    <bean parent="RelyingPartyByName" c:relyingPartyIds="https://fictitous
<https://sp1.example1/test>">
        <property name="profileConfigurations">
            <list>
                <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release"
/>
            </list>
        </property>
    </bean>

On Wed, Feb 15, 2017 at 1:00 PM, Tom Zeller <tzeller at dragonacea.biz> wrote:

> > Any guidance on where I could be missing? Thanks.
>
> Looks like you should remove
> p:postAuthenticationFlows="attribute-release" from your
> DefaultRelyingParty.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170217/04720ef0/attachment.html>