force consent for subject when consent is disabled otherwise

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2018-05-09 00:45]:
> So I'm wondering about possible ways to either stop the subject at the
> IDP (/iff/ the subject has opt'ed out somehow /and/ the SP matches one
> of the configured entity categories).  Or maybe force re-enabling of
> the consent intercept for this subject even though consent is
> generally disabled for these relying parties.
> (The later makes things rather complicated though, as you'd have the
> entity attribute to signal "no consent" for the SP, and another signal
> for "still force consent for subject" and possibly the subject
> actually consents at the IDP, in which case you'd have an external
> flag saying "opt-ed out from R&S" and a consent storage record that
> says "don't ask me again for this SP" or for R&S as such, if I create
> a duplicate from consent as "information screen". And rather than have
> these conflicting signals and methods the external flag signalling
> this special treatment of the subject should be removed, of course.)

Maybe it's not that bad. The above can be rephrased such that the
external flag (say, an LDAP attribute) simply switches off the special
treatment I've configured for R&S SPs (consisting in not asking
consent when it's otherwise globally active) and the subject then uses
R&S SPs under the same terms as any other subject uses non-R&S SPs --
by going through the consent intercept (and producing consent storage
records as evidence).

The external flag is probably never going to be cleared up, though.
If it is (local process) it likely makes sense to remove all existing
consent records for the subject administratively, though. (Requires
server-side storage of consent, but I guess at least some will prefer
that over hunting through consent audit logs in case they ever have to
provide evicence of consent given.)

So I guess the question of how to re-enable (otherwise disabled)
consent for a subject based on an LDAP attribute is still valid.

(Not a high priority for me now, so I'll save this until I will do
that deep dive into the documentation to finally understand intercepts
and flows and predicates and beans and everything, right after I'll
get a round tuit. ;))

-peter