revoking consent when proxying auth to other IDP

[Cantor, Scott]

> A "user profile page" showing your previously accessed services and
> the attributes released to them (however you would find it) would of
> course be the perfect place to click a few "X"s to revoke some of
> those decisions.

I have a hard time really believing users will find it or use somethiing like that, but in isolation I don't have a better idea.

> Well, the question of where to put such an UI and how would subjects
> find it was posed by Mihály on the REFEDS list earlier this year:

I vaguely recall, but your suggestion to raise it on any of our lists was not to my knowledge taken up, so I'm unaware of the work beyond that point.

FWIW, the hello world page in the IdP is more or less how this would be done. It's an administrative flow, essentially. And yes, the hardest part by far would be pulling in consent data.

-- Scott