Attribute Consent

[Joel Levin]

Thanks -- my mind may be finally wrapping itself around the concept.

Our goals:

-- turn off attribute consent be default to all applications
-- explicitly turn on by application's entityId

Is there anything I should change for following default setting?

 <!--
    Default configuration, with default settings applied for all profiles,
and enables
    the attribute-release consent flow.
    -->
    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="Liberty.SSOS" />
            </list>
        </property>
    </bean>

Prior to adding the entityIDs to trigger the attribute consent:

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://consent.to/me">
    <property name="profileConfigurations">
        <list>
            <bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release" />
        </list>
    </property>
</bean>

On Wed, Jan 25, 2017 at 5:50 PM, Klingenstein, Nate <
nklingenstein at calstate.edu> wrote:

> I believe it would look like:
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="https://
> consent.to/me" <https://consent.to/me>>
>     <property name="profileConfigurations">
>         <list>
>             <bean parent="SAML2.SSO"  p:postAuthenticationFlows="
> attribute-release" />
>         </list>
>     </property>
> </bean>
>
>
> On 01/26/2017 01:45 AM, Joel Levin wrote:
>
> Thanks Nate.
>
> >Let me know if you need a more detailed example,
>
> If you could -- that will be super helpful - i.e. with the entityID for
> application that requires attribute consent form.
>
>
>
> On Wed, Jan 25, 2017 at 5:29 PM, Klingenstein, Nate <
> nklingenstein at calstate.edu> wrote:
>
>> Joel,
>>
>> Yes, all you need to do is define a unique entityID for that application.
>>
>> Then, add a relying party override by name.  In that override, define a
>> reference to "attribute-release" on the SAML 2 configuration as a post
>> authentication flow.
>>
>> https://wiki.shibboleth.net/confluence/display/IDP30/ConsentConfiguration
>>
>> Let me know if you need a more detailed example,
>> Nate.
>>
>>
>> On 01/26/2017 01:08 AM, Joel Levin wrote:
>>
>> Is there a way to explicitly specify application whereby the
>> attribute-consent will appear?
>>
>> We do not need it for 95% of applications -- but require for 5% or so.
>>
>> j.
>>
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170126/934e36bd/attachment.html>