[JIRA] (JOIDC-142) Improve Request Object handling and configuration

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JOIDC-142?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 ) JOIDC-142 ( https://shibboleth.atlassian.net/browse/JOIDC-142?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 ) Improve Request Object handling and configuration ( https://shibboleth.atlassian.net/browse/JOIDC-142?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Authorization Endpoint Created: 17/Feb/23 7:39 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The OP plugin has supported request objects from the first version, but currently there’s no easy way control how they’re used in detail. The RP metadata contains fields for controlling the signing and encryption parameters, but they’re quite loosely specified [1] especially for encryption.

In addition to controlling the security parameters in a well-specified manner, some other improvement ideas:

* Force RPs to use request objects
* Force specific request parameters to be only defined in request object

The RP plugin has already extended *OIDCAuthorizationConfiguration* with the predicates for using, signing and encrypting request objects: they sound very useful to be implemented by OP too.

[1] https://openid.net/specs/openid-connect-registration-1_0.html ( https://openid.net/specs/openid-connect-registration-1_0.html )

( https://shibboleth.atlassian.net/browse/JOIDC-142#add-comment?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-142#add-comment?atlOrigin=eyJpIjoiNGNmYjc2Mzg3YTIwNDY1Njk0NmExOWNjY2I5YmY5MWIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100216- sha1:3fa9804 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230217/b70c16c3/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-52b31b6c-d5dc-452a-941a-32b6cf7236f6
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230217/b70c16c3/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-75a5f70c-a1c9-4d81-812e-4209966d24c6
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230217/b70c16c3/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-ac3016c7-4cac-4f42-9511-87c56e3d47a6
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230217/b70c16c3/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-2500d42b-3061-45ac-b1dd-b3dfbde34bb7
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230217/b70c16c3/attachment-0007.png>