[JIRA] (JOIDC-21) Use token authentication for OIDC dynamic client registration

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-21 ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiYzZkYWViZWM4YmNlNDNkMmIwYjJlYzQ2NWQ1M2Y2MjgiLCJwIjoiaiJ9 )

Re: Use token authentication for OIDC dynamic client registration ( https://shibboleth.atlassian.net/browse/JOIDC-21?atlOrigin=eyJpIjoiYzZkYWViZWM4YmNlNDNkMmIwYjJlYzQ2NWQ1M2Y2MjgiLCJwIjoiaiJ9 )

Merged in my raft of changes to the feature. I adjusted CLI parameter names, and made them all optional except that one of policyId or policyLocation is required. I added the ability to inject the client ID to use, and changed the onetime flag into an inverted signal allowing replacement of registration metadata with the same access token throughout its life. This only applies if client_id is also set.

All of the major settings are now checked by a named access control policy governing use of the policy ID, location, and client ID by the caller, by default the localhost rule.

I adjusted the registration flow so that if there’s no relyingPartyId in the token, it falls back to the unverified RP as before, and of course there may be a policy attached to that.

I think both the operator issuing tokens and developers getting their own tokens use cases should be pretty well handled by this change.

( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiYzZkYWViZWM4YmNlNDNkMmIwYjJlYzQ2NWQ1M2Y2MjgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-21#add-comment?atlOrigin=eyJpIjoiYzZkYWViZWM4YmNlNDNkMmIwYjJlYzQ2NWQ1M2Y2MjgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:8522567 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220315/00d68678/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-37c6b6b4-8033-4c32-bfba-9d5064c0d04b
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220315/00d68678/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-a5d2f4af-6f09-4ae0-86a4-57bbd8100958
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220315/00d68678/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-120e0c50-6862-45a1-9864-7d2af39c4383
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220315/00d68678/attachment-0005.png>