<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Darren,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 19 Aug 2020, at 15.52, Darren Boss <<a href="mailto:darren.boss@computecanada.ca" class="">darren.boss@computecanada.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">I don't have all that many OIDC clients yet and most are applications<br class="">developed in house. I just setup Harbor which is an open source<br class="">container registry with OIDC as they don't support SAML. I'm getting<br class="">the attribute consent release on every authentication and seeing<br class="">|harbor|ClearAttributeReleaseConsent|myuid||||<br class="">in the logs.<br class=""><br class="">I double checked all the other registered OIDC clients and none of<br class="">them exhibit this behavior and a few of them have the same scopes or<br class="">even an additional scope configured and behave normally.</div></div></blockquote><br class=""></div><div>I’d check if Harbor includes prompt=consent in the OIDC authentication request message [1]. Also, if offline_access scope is granted to the RP and it’s requested in the authn request [2], the consent is asked from the end-user again.</div><div><br class=""></div><div>BR,</div><div>Henri.</div><div><br class=""></div><div>[1] <a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest" class="">https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest</a></div><div>[2] <a href="https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess" class="">https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess</a></div></body></html>