Attribute release consent failing (sometimes)

[Tom Zeller]

On Tue, Sep 12, 2017 at 10:49 AM, Manuel Haim <haim at hrz.uni-marburg.de> wrote:
> Hi list,
>
> with my IdP 3.3.1, I seem to have the problem that about 2% of my users
> (or their browsers) fail to pass the attribute release consent page
> (attribute-release.vm) correctly.
>
> It appears as if the users have unchecked their consent for each single
> attribute. However, the idp.consent.allowPerAttribute option is disabled
> (default), so there are no checkboxes for each attribute, but hidden
> fields like this:
>
> <input id="sn" name="_shib_idp_consentIds" value="sn" type="hidden" checked>
>
>
> The consent is stored in a database (table 'storagerecords') where I see
> several entries like this (with "appr":false, as if checkboxes for the
> single attributes have been unchecked):
>
> [{"id":"sn","v":"XXXXXXXX","appr":false}]
>
>
> Has anybody had the same problem? Could it be that some browsers have a
> problem with the "checked" attribute on a hidden field (i.e. not a
> checkbox)? Any other ideas?

If you set the log level of
net.shibboleth.idp.consent.flow.impl.ExtractConsent to DEBUG, you
should see the attribute ids returned from the browser, as well as
whether isApproved is true or false. That should help determine if the
browser is the culprit (if you see isApproved=false instead of
isApproved=true).

Looks like idp.consent.compareValues is true (otherwise values are not
stored in consent storage records). Maybe values are not comparing
correctly, resulting in false approval. That's the only other place in
the code[1] where n.s.i.consent.impl.Consent.setApproved(false) is
called. Unfortunately, I don't see a way to log value comparison. I
imagine you could deduce whether values are being compared incorrectly
by looking at your database logs.

HTH
Tom

[1] https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributeReleaseConsentFunction.java;h=1e8844c95fc468ae03e9a08e20d3e39d4638c020;hb=4d937c28ef9cca81f7422572b29a0b4f97f62ce1#l150