Attribute Consent

[Klingenstein, Nate]

I believe it would look like:

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://consent.to/me"<https://consent.to/me>>
    <property name="profileConfigurations">
        <list>
            <bean parent="SAML2.SSO"  p:postAuthenticationFlows="attribute-release" />
        </list>
    </property>
</bean>


On 01/26/2017 01:45 AM, Joel Levin wrote:
Thanks Nate.

>Let me know if you need a more detailed example,

If you could -- that will be super helpful - i.e. with the entityID for application that requires attribute consent form.



On Wed, Jan 25, 2017 at 5:29 PM, Klingenstein, Nate <nklingenstein at calstate.edu<mailto:nklingenstein at calstate.edu>> wrote:
Joel,

Yes, all you need to do is define a unique entityID for that application.

Then, add a relying party override by name.  In that override, define a reference to "attribute-release" on the SAML 2 configuration as a post authentication flow.

https://wiki.shibboleth.net/confluence/display/IDP30/ConsentConfiguration

Let me know if you need a more detailed example,
Nate.


On 01/26/2017 01:08 AM, Joel Levin wrote:
Is there a way to explicitly specify application whereby the attribute-consent will appear?

We do not need it for 95% of applications -- but require for 5% or so.

j.




--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170126/7271fa16/attachment.html>