diff --git a/modules/consent/docs/consent.txt b/modules/consent/docs/consent.txt index 2c5757409e6fc387a6ae356b3997806acd0a2362..bd78b73b0247cdd78c6740259d14b557c728a8d5 100644 --- a/modules/consent/docs/consent.txt +++ b/modules/consent/docs/consent.txt @@ -187,26 +187,49 @@ The following options can/ be set in other places in simpleSAMLphp Disabling consent ----------------- -It is possible to disable consent for a given service. You can add an option -in the metadata on the IdP, that will disable consent for the given service. -Add 'consent.disable' array option and enter the entityids of the services, -that you do not want consent for. +Consent can be disabled either in the IdP metadata or in the SP metadata. +To disable consent for one or more SPs for a given IdP, add the +`consent.disable`-option to the IdP metadata. To disable consent for one or +more IdPs for a given SP, add the `consent.disable`-option to the SP metadata. -Example: +### Examples ### + +Disable consent for a given IdP: + + $metadata['https://idp.example.org/'] = array( + [...], + 'consent.disable' => TRUE, + ); + +Disable consent for some SPs connected to a given IdP: - 'consent.disable' => array( - 'sp.example.com', - 'sp2.example.com', - ... + $metadata['https://idp.example.org/'] = array( + [...], + 'consent.disable' => array( + 'https://sp1.example.org/', + 'https://sp2.example.org/', + ), + ); + + +Disable consent for a given SP: + + $metadata['https://sp.example.org'] = array( + [...] + 'consent.disable' => TRUE, ), -It is also possible to disable consent for all SPs for a given IdP by setting -the 'consent.disable' option to TRUE: +Disable consent for some IdPs for a given SP: - 'consent.disable' => TRUE, + $metadata['https://sp.example.org'] = array( + [...] + 'consent.disable' => array( + 'https://idp1.example.org/', + 'https://idp2.example.org/', + ), + ), - Attribute presentation ---------------------- diff --git a/modules/consent/lib/Auth/Process/Consent.php b/modules/consent/lib/Auth/Process/Consent.php index d343506bdd44097d0ec8933b16e7996ea9ebb285..eff89c43808d3c466334d96b8365031fbffb165a 100644 --- a/modules/consent/lib/Auth/Process/Consent.php +++ b/modules/consent/lib/Auth/Process/Consent.php @@ -181,9 +181,13 @@ class sspmod_consent_Auth_Process_Consent extends SimpleSAML_Auth_ProcessingFilt $state['Source'] = $idpmeta; } - // Do not use consent if disabled on source entity + // Do not use consent if disabled if (isset($state['Source']['consent.disable']) && self::checkDisable($state['Source']['consent.disable'], $spEntityId)) { - SimpleSAML_Logger::debug('Consent: Consent disabled for entity ' . $spEntityId); + SimpleSAML_Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId); + return; + } + if (isset($state['Destination']['consent.disable']) && self::checkDisable($state['Destination']['consent.disable'], $idpEntityId)) { + SimpleSAML_Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId); return; }