[JIRA] (JOIDC-21) Use token authentication for OIDC dynamic client registration

[Keith Wessel (Jira)]

Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed ) *commented* on JOIDC-21 ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiNzgzY2NjMzg4ZjVjNDg1NmEzNDk2NjUzZTE5NGExZGUiLCJwIjoiaiJ9 )

Re: Use token authentication for OIDC dynamic client registration ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiNzgzY2NjMzg4ZjVjNDg1NmEzNDk2NjUzZTE5NGExZGUiLCJwIjoiaiJ9 )

Personally, I don’t want to be in the business of creating registration tokens for my developers as the IdP admin. But I do want to be able to control who can request them. I don’t, for instance, what a resourceful undergrad to start registering OIDC clients in my IdP. So, if the eoken issuing endpoint you’re talking about is one that issues barer tokens that developers can use to authenticate to the registration endpoint and register clients, then yes, I need some access control around it. I would prefer to allow select users (such as those in a given group) to get their own tokens, though, and use them to register clients. I can’t see a use case for myself right now where I would register tokens for them as the IdP admin. I won’t rule it out, but it’s not likely.

( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiNzgzY2NjMzg4ZjVjNDg1NmEzNDk2NjUzZTE5NGExZGUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiNzgzY2NjMzg4ZjVjNDg1NmEzNDk2NjUzZTE5NGExZGUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:b6de2d8 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/40fff425/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-df16272c-7518-4bf6-85a6-3dedde6a293b
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/40fff425/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-97b4741c-9744-4785-8e81-0a6abd247867
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/40fff425/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-9af031c0-32d6-4de1-99d9-e0049cabaa93
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/40fff425/attachment-0005.png>