attribute-release in OIDC

[Cantor, Scott]

On 3/14/22, 7:52 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>    If that were true, I would think it would have been reported by now,

I suspect the reason is you're using per-attribute consent and generally that's rare so it hasn't been reported. The condition triggers on that because the original code wasn't designed to capture the values approved if the data wasn't bring provided at that time.

I don't know if it's fixable but the OIDC code is capable of embedding it all in the tokens so we probably can come up with a more complex condition to check to allow for that case.

-- Scott