RE: [security-services] Issue CORE-21: Consent vs. Reason

[Scott Cantor <cantor.2@osu.edu>]

> BTW, the reason why I'm sending out all these messages about open issues 
> is that ideally we should close all "normative-text-related" issues 
> before we go to last call.  This just seems right to me.

I would agree, but since I'm the one doing a lot of the spec, when I have
the issue, it's tough to make it happen.

The problem is that there's an overlap between the set of constants in each
category (even assuming we have defined those constants, which I don't think
is even true in the case of Consent, which is also an issue).

There are constants for "Reason" that, IMHO, amount to "Consent" values. An
example would be logout reasons of "user logged out" and "admin logged user
out". Those are consent conditions, not reasons for logout. The Reason might
be "explicitly logged out" vs "timeout".

Consent was vaguely specified in ID-FF to begin with. Adding Reason into the
mix, when they overlap, just makes things worse.

-- Scott