force consent for subject when consent is disabled otherwise

[Tom Zeller]

 >> So I guess the question of how to re-enable (otherwise disabled)
>> consent for a subject based on an LDAP attribute is still valid.
>
> And Keith's example will likely answer all that, too, once I make the
> effort of trying to actually digest it.
> http://shibboleth.net/pipermail/users/2018-February/039201.html

In that example, I will guess that "FERPASuppressedUser" and
"NoConsentNeeded" etc. are attribute checking activation
conditions[1]. Seems like those are the building blocks of the logic
(activation condition for a profile intercept flow) you want to
create.

I do not see documentation on how to add an activation condition to a
profile intercept[or] flow. Based on the given example, probably by
adding

  p:activationCondition-ref="ConsentActivationConditions"

to

 <bean id="intercept/attribute-release"
parent="shibboleth.consent.AttributeReleaseFlow" />

in conf/intercept/profile-intercept.xml.

In addition to controlling whether or not the consent
(attribute-release or terms-of-use) flows are run (via an activation
condition), you can also control on a per-subject basis via an
activation condition / predicate, which defaults to the
IsConsentRequiredPredicate. But that is deeper in the flow and you
probably do not want to go there.

HTH,
Tom

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-AttributeChecking