Full Title or Meme
- During an authorization request by a Relying Party, the Identifier or Attribute Provider requires user consent redirecting the user to the consent page.
- Consent is used to allow an end user to grant a client access to resources (identity or API).
User consent is discussed in the GDPR for transfers of User Information between two Data Controllers on the internet. It is not clear if the GDPR or other regulations apply to a site that collects user data for its own purposes and does not further process or share that User Information. Nor is any temporal relationship between User Consent acts described. So it is not clear if a new User Consent arrives, what action should be taken vis a vis any prior consents. If older consents are not invalidated, it is unclear how to evaluate conflict between the different consents.
In this wiki it is assumed that there can exist only one active User Consent among three parties on the internet, the Subject (aka User) the Identifier or Attribute Provider and the Relying Party. It is unclear if User Consent has any specific meaning between the Subject and the Identifier or Attribute Provider; that is left for further developments.
In order for the user to grant consent, a consent page must be provided by the Identifier or Attribute Provider.
- A consent page normally renders the display name of the current user, the display name of the Relying Party (aka client) requesting access, the logo of the client, a link for more information about the client, and the list of resources the client is requesting access to. It’s also common to allow the user to indicate that their consent should be “remembered” so they are not prompted again in the future for the same client.
- Once the user has provided consent, the consent page must inform Identifier or Attribute Provider of the consent, and then the browser must be redirected back to allow the user to continue where they left off.
Back at the Relying Party
The User Consent provided might not align exactly with what the RP requested. In that case the RP may accept the consent granted, or it may need to go back to the user for additional Attributes or some Validation of the Attributes.