Handle Revoking Consent on CAS side

[rkorn86]

As there is no login.vm displayed, but we have the CAS login theme, there should be some way to let the user revoke their release attribute grants on CAS side.
So first there should be some UI on the CAS Login Page, like the checkbox defined in shibboleth' login.vm

              <div class="form-element-wrapper">
                <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true">
                #springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")
              </div>

And second there should be some worker, setting a request param for shibboleth, so that this decision flow from system/flows/intercept/attribute-release-flow.xml is executed.

    <!-- If consent revocation was requested, skip reading from storage. -->

    <decision-state id="TestForRevokeConsent">
        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.consent.context.ConsentManagementContext), true).getRevokeConsent()"
            then="RevokeConsent" else="ReadConsentFromStorage" />
    </decision-state>

[mmoayyed]

All of the changes you describe relate to either CAS or Shib. There is nothing for this plugin to do.

[rkorn86]

The work to be done on this plugin is to set ExternalAuthentication.REVOKECONSENT_KEY based on the users checkbox (which is not existing yet) setting on CAS side in a new class implementing CasToShibTranslator like request.setAttribute(ExternalAuthentication.REVOKECONSENT_KEY, authenticatedPrincipalWantsToRevokeConsent);
Do get this done, an upgrade to IdP 3.2.0 is required. See also on http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/ExternalAuthentication.java?view=markup#l64

[rkorn86]

@mmoayyed Could you please reopen the issue?

[rkorn86]

While doing some hardcoded tests with request.setAttribute(ExternalAuthentication.REVOKECONSENT_KEY, true) inside a translator and an updated dependency on idp 3.2.0-SNAPSHOT, I only get a blank page hanging on https://idp.example.com/idp/Authn/ExtCas?conversation=e1s1&ticket=ST-XXX. When setting ExternalAuthentication.REVOKECONSENT_KEY to false, everything works fine like before on old IdP dependent version.

[lmaylein]

Same problem here (we have our own external authentication module). Blank page and no hint in the logs. Are there any news/tipps?

[mmoayyed]

You may want to discuss this on the shib-dev mailing list.