[JIRA] (JOIDC-161) Support unregistered clients at authz endpoint

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JOIDC-161?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 ) JOIDC-161 ( https://shibboleth.atlassian.net/browse/JOIDC-161?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 ) Support unregistered clients at authz endpoint ( https://shibboleth.atlassian.net/browse/JOIDC-161?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 )

Issue Type: New Feature Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Authorization Endpoint Created: 01/Jun/23 2:10 PM Fix Versions: 4.0.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

We need to come up with a solution for allowing unregistered clients to use the SSO endpoint by providing some kind of alternative response location validation solution. Most everything else should be possible to default but we need a way to regulate things without full-blown metadata if we can.

One thought I had is just to implement as a starting point a simple map-based solution that feeds in a set of rules for this, a subset of metadata in some sense, but purely local in nature. That could also allow regexes of course.

I don’t think the CAS approach is a fit because it doesn’t indirect between the client identifier and the location, but this has to allow for that. But something resembling the CAS service registry might work if it’s extended.

If nothing else, a map is good enough to make it possible and it can evolve from there.

The vision as I outlined with the original OAuth work is that I don’t think campus apps need to be dealt with as snowflakes. Having default behavior for campus that doesn’t involve any registration with the IdP and strictly relies on client authentication via service accounts should go a long way. Of course, keys are great too but if you want clients with keys, that’s metadata.

( https://shibboleth.atlassian.net/browse/JOIDC-161#add-comment?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-161#add-comment?atlOrigin=eyJpIjoiYTY5Mjk0ZjczN2RjNDNjZDlmN2NhNzYxOGI3ZmRlM2IiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:40c4da4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230601/a9969a11/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-2a0a80b6-cae4-4577-833c-7616cdcb071b
Type: image/png
Size: 302 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230601/a9969a11/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e6204ad3-1221-4ff3-a339-a26ae8f57ef6
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230601/a9969a11/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-e53d44fd-46ce-431f-954b-30c724c5d686
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230601/a9969a11/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-27c74cdf-aa3d-45eb-94eb-67ef17c7a7ac
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230601/a9969a11/attachment-0007.png>