revoking consent when proxying auth to other IDP

[Peter Schober]

How would one handle consent revocation -- the equivalent of ticking
the checkbox for "idp.attribute-release.revoke" on the IDP's login
page -- when the IDP proxies/outsources authentication to another IDP
(e.g. via SAML or OIDC, which seems to be the popular choice in order
to get Strong Authentication/MFA capabilities in to your Shib IDP)?

In such deployments the IDP's own login page is never shown,
consequently there's no place to put the
"idp.attribute-release.revoke" checkbox.

The upstream/proxied IDP cannot perform this task as it doesn't know
anything about the Shibboleth IDP or what data that would release.

With no such UI element there's no way to revoke previously given and
persisted consent. Seems the only obvious way to handle consent with
proxied/outsourced authentication is to not persist anything and
always pester the subject with the consent UI, on each and every
access even to the same service. Clearly (to some) that's not ideal.

A possible workaround might be storing consent records with a rather
short lifetime so that you'd only be asked again about the same
service every 30 days or whatever. That would lessen some of the pain
of having to repeatedly "consent" as part of your daily work -- but
may fail some legal requirements:
Some legal frameworks require that for "consent" to be legal (among
other things) it must also be revocable at any time.

I notice there's some work happening in GÉANT to produce a "user
profile page" for the Shib IDP where essentially consent storage
records would be shown to the authenticated subject:
https://gitlab.software.geant.org/TI_Incubator/user-profile-page-shibboleth
But on the GÉANT wiki
https://wiki.geant.org/pages/viewpage.action?pageId=351240339
the possibility of using this to also revoke some of those records is
only listed as an "Additional features to consider":
"It should be investigated if this feature could also be used to allow
users to retract consent to the release of attributes/claims".

Comments, suggestions, ideas?

Best regards,
-peter