consent not working in CAS

[Bergmann, Clemens]

Hi,

 

we use the consent-intercept with idp.consent.allowPerAttribute = true. When a user removes one of the checkboxes the corresponding attribute values are not transmitted for SAML and oidc. They are also excluded when using SAML2 Attribute Queries to get the attributes. If we use the CAS Protocol all attributes are always in the Response of the /validate endpoint.

 

The relevant bean seems to be shibboleth.consent.AttributeQuery.Condition which is set to “shibboleth.Conditions.TRUE” in conf/intercept/consent-intercept-config.xml

 

I looked into the corresponding validate-abstract-flow.xml [1] to find out why this is not working. After setting the logger org.springframework.webflow.engine to DEBUG I can see the state transitions. After reaching CheckConsentCondition the flow is skipping the ConsentSetup state and continues to PopulateOutboundInterceptContext directly. It seems that shibboleth.consent.AttributeQuery.Condition is not defined at that point. That seems right because consent-intercept-config.xml is only imported  in the -beans.xml of the attribute-release flow which is only called later in validate-abstract-flow.

 

I also found that attribute-query-beans.xml directly imports consent-intercept-config.xml and therefore the shibboleth.consent.AttributeQuery.Condition is available at the CheckConsentCondition state. 

 

When I move the definition of the shibboleth.consent.AttributeQuery.Condition bean to global.xml the attributes are filtered out.

 

Is there something I don’t understand or that I could configure correctly or is the <import> missing in validate-abstract-flow-beans.xml?

 

[1] https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/validate-abstract-flow.xml 

 

With kind regards

Clemens (Bergmann)

 

-- 

Clemens Bergmann

[er/ihm; he/him]

Gruppe Nutzermanagement und Entwicklung

Technische Universität Darmstadt

Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt

Tel. +49 6151 16 71184

 <http://www.hrz.tu-darmstadt.de/> http://www.hrz.tu-darmstadt.de/

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241216/fb773e1c/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7338 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20241216/fb773e1c/attachment.p7s>