revoking consent when proxying auth to other IDP

[Cantor, Scott]

I would probably argue that consent belongs with the IdP acting as a user interface. I believe most of the obvious options all support it.

Realistically, no interstitial page would make sense as it would interfere with things and have to be displayed more or less every time to be useful.

> I notice there's some work happening in GÉANT to produce a "user
> profile page" for the Shib IDP where essentially consent storage
> records would be shown to the authenticated subject:

Noone has mentioned it to us, but it's been a backlogged item for a while to do something along those lines.

-- Scott