revoking consent when proxying auth to other IDP

[Peter Schober]

* Scott Cantor <cantor.2 at osu.edu> [2023-08-01 20:33]:
> Realistically, no interstitial page would make sense as it would
> interfere with things and have to be displayed more or less every
> time to be useful.

That's more or less the point I was trying to make: Persisting consent
would become much less useful if there was no practical way for
subjects to also revert some of those decisions later on.

I'd accept that with proxying authentication to another IDP there's no
natural/obvious/possible place to ever show the subject where they
actually could revoke previously given consent (short of always asking
for consent and never persisting any choices) -- but having that
functionality *somewhere* would at least allow deployers to document
and refer people to such a URL/service as needed.

A "user profile page" showing your previously accessed services and
the attributes released to them (however you would find it) would of
course be the perfect place to click a few "X"s to revoke some of
those decisions.

> > I notice there's some work happening in GÉANT to produce a "user
> > profile page" for the Shib IDP where essentially consent storage
> > records would be shown to the authenticated subject:
> 
> Noone has mentioned it to us, but it's been a backlogged item for a
> while to do something along those lines.

Well, the question of where to put such an UI and how would subjects
find it was posed by Mihály on the REFEDS list earlier this year:
https://lists.refeds.org/sympa/arc/refeds/2023-05/msg00006.html

The consent revocation aspect I was asking about is only mentioned as
an "Additional features to consider" (cf. the geant wiki page I
referenced before) but there seems to be functional code and UI code
available for the initially targeted functionality.

-peter