attribute-release in OIDC

[Bergmann, Clemens]

Hi,

 

we currently try to configure OIDC on our IDP.

We have ‘attribute-release’ configured as postAuthenticationFlows for the SAML2.SSO Profile and also idp.consent.allowPerAttribute is true but idp.consent.attribute-release.activationCondition is never configured. We also want to enable it for OIDC.SSO. Unfortunately the consent is never shown.

When looking at the debug log I find the following line:

[…] Flow intercept/attribute-release was not applicable to this request

I checked with the code and found that the bean ‘shibboleth.consent.AttributeReleaseFlow’ has an activationCondition [1] that tests against net.shibboleth.idp.saml.profile.config.logic.IncludeAttributeStatementPredicate in this situation.

This predicate however is not aware of the OIDC profiles and therefore always returns false when called in these profiles.

The token endpoint on the other hand correctly checks if there is a consent for the attributes about to be released. 

Therefore when using the oidc “Authorization Code Flow” the code returned does not return any claims.

 

Can you tell me what my problem is or how I might overcome this. I can only think of extending ‘intercept/attribute-release’ with a custom intercept and overriding the activationCondition with something OIDC aware but that seems a little much.

 

[1] https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml#l50

 

Viele Grüße

Clemens (Bergmann)

-- 

Clemens Bergmann

Gruppe Nutzermanagement und Entwicklung

Technische Universität Darmstadt

Hochschulrechenzentrum, Alexanderstraße 2, 64289 Darmstadt

Tel. +49 6151 16 71184

 <http://www.hrz.tu-darmstadt.de/> http://www.hrz.tu-darmstadt.de/

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220314/968d0cc9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6377 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20220314/968d0cc9/attachment.p7s>