Shibboleth Developers

["Michael A. Grady" <>]

On Jun 10, 2010, at 3:04 PM, Scott Cantor wrote:

>> This sort of consent often comes with a statement by the SP that
>> explains why they need the attributes and what they will or will not do
>> with them.
>> 
>> Will there be any way to provide that information?  In the metadata?

Putting all that in the metadata, and then turning around and trying to 
present that all to the user, as well the attributes to be released and their 
values, sounds like one ends up creating a web page with so much info the 
average user will never read it (like EULAs). But asking services to have a 
web page with its privacy policy, why it needs the attributes and what it 
will do with them (and how it will protect them), and putting a URL pointing 
to that web page in the metadata (and presenting that URL on the consent 
page) might work. (Still probably won't get the average user to go and read 
that page, but at least you've tried.)

> 
> I think we need to come up with a way to achieve consensus on what the
> requirements are before we know what the solution will be, or whether the
> metadata can accommodate it.
> 
> But that sounds to me like a proposed requirement that isn't currently in
> scope.
> 
> -- Scott
> 


--
Michael A. Grady                      
Executive Program Officer for Cyberinfrastructure
Office of the CIO, University of Illinois at Urbana-Champaign
2222 DCL, MC 256, 1304 W. Springfield Ave., Urbana, IL 61801
217.244.1253 phone, 217.244.4780 fax