Relying party override for anything from ukfederation MDQ

[Cantor, Scott]

> And I can reference it in a relying party override: 

You don't need to do that, just use the metadata-driven config features and change the profile bean to SAML2.SSO.MDDriven, and then your tag will apply automatically to configure the feature.

Overrides are unneeded now if you're using metadata tagging as long as you ensure the tags are injected locally (either because the metadata is local, you trust the source, or you strip any existing tags from remote sources).

You're also using the wrong tag name. The securityConfiguration tag suffix is for that setting alone, it's used to designate an overriden bean to configure security algorithms. The feature you're trying to trigger is the postAuthenticationFlows setting, but even in that case, you'd only use that if you're using the metadata-driven config features to drive our code, not your own.

*Never* attach your own meaning to a tag we define. Use your own tags for that. It would be bad for somebody later on to inherit that, they'd be lost as to what the securityConfiguration tag has to do with enabling consent.

In this case, you want the "http://shibboleth.net/ns/profiles/postAuthenticationFlows" tag with the value of "attribute-release" to get consent turned on.

> What I can’t work out is how to make this apply to all entityIDs

            <ConditionRef>shibboleth.Conditions.TRUE</ConditionRef>

Filters can be attached based on Entity lists or conditions in a bean or a script.

-- Scott