[JIRA] (JOIDC-21) Use token authentication for OIDC dynamic client registration

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-21 ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiYjllZDEzNTNhOGZkNGZlZThkOTgzNzI2YWQzY2RmYjAiLCJwIjoiaiJ9 )

Re: Use token authentication for OIDC dynamic client registration ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiYjllZDEzNTNhOGZkNGZlZThkOTgzNzI2YWQzY2RmYjAiLCJwIjoiaiJ9 )

It’s going to make calls into the AccessControl service, much like impersonation does. The trick is coming up with sensible inputs to the access check (allowing that it can always look at anything) so that simple/expected use cases for limiting access are easy to define.

Much like impersonation, the group example is straightfoward because the “who” part of the check can be delegated to checking a resolved attribute (i.e. a group).

What I’m trying to constrain is the “what” part of the check to as little authorization “context” as possible since the more stuff somebody can feed into the endpoint, the more complex the access rules have to be to account for all the things they might request.

( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiYjllZDEzNTNhOGZkNGZlZThkOTgzNzI2YWQzY2RmYjAiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiYjllZDEzNTNhOGZkNGZlZThkOTgzNzI2YWQzY2RmYjAiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:b6de2d8 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/b9af090a/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-97cc5880-e447-4ddd-b308-99aed4b32b6a
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/b9af090a/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f18550e0-86cf-4aeb-812a-2efbce738c38
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/b9af090a/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-8fa17dde-48ff-456c-9ce2-d545d6ebe12d
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220310/b9af090a/attachment-0005.png>