allowPerAttribute=true + all unchecked + 8443 = unintended attribute release

[Cantor, Scott]

On 1/26/18, 6:17 PM, "users on behalf of Takeshi NISHIMURA" <users-bounces at shibboleth.net on behalf of takeshi at nii.ac.jp> wrote:

> This is another issue when enabling the back channel on Shibboleth IdP.
> We have experienced odd behavior that resulted in unintended attribute release.

We have been, I think, clear that the back channel does not and will not pay any attention to consent. If that ever changes, we'll certainly document that change.

> Actual final result of this situation is that Shibboleth SP gets all the attributes which are displayed in the consent page
> through Attribute Query, as it is the default behavior of Shibboleth SP when it gets no attribute assertion. It is also the
> default behavior of Shibboleth IdP to send all the attributes in attribute-filter.xml through Attribute Query, regardless of
> with or without the user's consent.

Yes, that is what I'd expect it to do.

-- Scott