Issue with attribute release consent

[Darren Boss]

Apologies for messing up the message threading. Waiting for an email
or an admin approval to change my email address on the mailing list or
register under my new email address.

I did a full logout, not just SP as I had to re authenticate again.

As for provisioning of data, I can talk to the CCDB developers but
it's my understanding that unless an attribute changes, no
provisioning to ldap is done. Even if it was, the values were the same
and I explicitly enabled "idp.consent.compareValues = false" which I
believe is the default. I also picked an SP with limited attributes to
test with for this reason.

I just tried again with the same SP, my SP and IdP session were over
but I didn't do an explicit logout. I didn't get prompted for
information release so it seems like it takes some time between access
to trigger. I haven't changed defaults so my understanding is consent
information shouldn't expire or maybe it's one year?

I also believe that it's html5 storage and not cookies for client
storage again because I haven't tweaked any of the default besides
compareValues. There is no backend storage.

One thing about triggering consent was ldap doesn't promise anything
about the order of multi valued attributes according to our ldap guru
so I was thinking that might be triggering it but again, I've got
compareValues = false so that shouldn't matter anyway.

>Darren,
>
>> When I access any SP after not visiting it that day, the Information
>> Release screen is displayed. If I accept, logout
>
>I presume you mean logout from the SP and SP only.
>
>> and access that same
>> SP again I get redirected to login, but the Information Release view
>> is not displayed.
>
>SSO is happening properly, in other words.
>
>> When I come back the next day, I get prompted again.
>
>This may be intended behavior based on whether the released information has changed.  That seems like the most likely culprit, especially if you're running overnight provisioning or data warehousing jobs.
>
>https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631715/ConsentConfiguration#Attribute-Release-Consent
>
>> What can I do to debug this issue further?
>
>I guess you could also check cookie expiration and persistence, but this smells like the underlying data changing.
>
>Take care,
>Nate