puzzled about the activationCondition of the AttributeReleaseFlow

[Dominique Petitpierre]

Hello,

I cannot make sense of the logical expression for the activationCondition that determines the applicability of the attribute release consent flow if it is configured:
http://svn.shibboleth.net/view/java-identity-provider/tags/3.1.2/idp-conf/src/main/resources/system/conf/profile-intercept-system.xml?view=markup#l46

Essentially it is

   (NOT(idp.consent.allowPerAttribute) OR getProfileConfig().includeAttributeStatement())

cf.
http://svn.shibboleth.net/view/java-identity-provider/tags/3.1.2/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/IncludeAttributeStatementPredicate.java?view=markup#l67

What is the logic behind this? more specifically
- Why should the activation depend on the value of idp.consent.allowPerAttribute?
  I.e. idp.consent.allowPerAttribute controls only the modality of the user consent for attributes: be it true or false, one would want to ask/check the consent of the user to release some attributes if the other conditions are met.
- Conversely: why ignore includeAttributeStatement() if idp.consent.allowPerAttribute=false?
- What happens if activationCondition evaluates to false and the attribute release consent flow is not applicable: should the filtered attributes be released or not?

Here is what the idp-process.log show in this latter case:

2017-01-24 17:21:58,758 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:106] - jsessionID:805DC7D951B08C0C9A1FFD410C07E298 - Profile Action SelectProfileInterceptorFlow: Flow intercept/attribute-release was not applicable to this request


Puzzled and curious,
Dominique

Mr Dominique Petitpierre, user=Dominique.Petitpierre domain=unige.ch
IT Division, University of Geneva, Switzerland