**EXTERN** Re: Multi value attribute selection

[Orlandis Brown]

Yes that seems like the correct approach regarding consent choice storage,
according to:

"Users will be prompted to consent to attribute release at every log in.
This is implemented by not storing consent."

And the section on storage -> retention from that page.

On Mon, Jun 22, 2026, 3:49 AM Bergmann, Clemens <
clemens.bergmann at tu-darmstadt.de> wrote:

> Hi Orlandis,
>
> that is an interesting idea. We use the intercept with per-attribute
> consent. One problem I see there is that this intercept only shows if the
> attributes or the values change. In our usecase we always want to show it.
> We might be able to do this by setting lifetimeLookupStrategy-ref to a
> function that returns 0 for this SP and "infinite" for all others.
>
> Mit freundlichen Grüßen
> Clemens (Bergmann)
>
> --
> Clemens Bergmann
> [er/ihm; he/him]
> Team Linux/Team IDM
> Technische Universität Darmstadt
> Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
> <https://www.google.com/maps/search/Alexanderstra%C3%9Fe+2,+64283+Darmstadt?entry=gmail&source=g>
> Tel. +49 6151 16 71184
> Matrix: @cb50tory:matrix.tu-darmstadt.de
> http://www.hrz.tu-darmstadt.de
>
> Am Montag, dem 22.06.2026 um 03:37 -0800 schrieb Orlandis Brown:
> > I wonder if the Attribute Release Consent intercept (
> > https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509862) can
> be
> > used for this, since it can also do per-attribute consent. Maybe you
> could
> > set up multiple attribute definitions with the same SAML encoding but
> > different source values. With some editing of the consent view, you might
> > be able to present the exclusive attributes (or just their value) in a
> > drop-down select, and have the normal set of attributes automatically
> > marked for release.
> >
> > On Mon, Jun 22, 2026, 2:43 AM Bergmann, Clemens via users <
> > users at shibboleth.net> wrote:
> >
> > > Hi,
> > >
> > > we have a SP that can only work with one value in an attribute. This
> > > attribute can have multiple values for one user in our IDM-System. The
> > > "correct"
> > > value can change over time. I am looking for a solution that first
> > > resolves the attribute and then allows the user to select the current
> value
> > > they
> > > want to send to the SP.
> > >
> > > My first idea was to add an intercept that presents and sets the
> selected
> > > value and then influence a AttributeDefinition based on that selection.
> > > Before I get deeper into this idea I wanted to check if this sounds
> > > possible from a conceptual perspective and if someone already has
> configured
> > > something alike.
> > >
> > > Kind regards
> > > Clemens (Bergmann)
> > >
> > > --
> > > Clemens Bergmann
> > > [er/ihm; he/him]
> > > Team Linux/Team IDM
> > > Technische Universität Darmstadt
> > > Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
> > > <
> https://www.google.com/maps/search/Alexanderstra%C3%9Fe+2,+64283+Darmstadt?entry=gmail&source=g
> >
> > > Tel. +49 6151 16 71184
> > > Matrix: @cb50tory:matrix.tu-darmstadt.de
> > > http://www.hrz.tu-darmstadt.de
> > > --
> > > For Consortium Member technical support, see
> > > https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > > To unsubscribe from this list send an email to
> > > users-unsubscribe at shibboleth.net
> > >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260622/71325a55/attachment.htm>