[JIRA] (JOIDC-155) Documentation lacks clear description of interaction between introspection and audience

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-155 ( https://shibboleth.atlassian.net/browse/JOIDC-155?atlOrigin=eyJpIjoiNzU3OTNiNDViMDdhNDBjYzgxYWZmMmYwMDM5ZDY5ZTkiLCJwIjoiaiJ9 )

Re: Documentation lacks clear description of interaction between introspection and audience ( https://shibboleth.atlassian.net/browse/JOIDC-155?atlOrigin=eyJpIjoiNzU3OTNiNDViMDdhNDBjYzgxYWZmMmYwMDM5ZDY5ZTkiLCJwIjoiaiJ9 )

Yeah, that’s what I suspected, if anything was enforcing it, it’s not us. That shouldn’t matter though…it turns out that’s right, https://www.rfc-editor.org/rfc/rfc8707.html covers that, it’s a requirement. (Of course it’s also required by SAML, but for some odd reason Nimbus thinks specs should be followed…heh)

But that shouldn’t cause any issues here because again, the client itself is always allowed to introspect the token. If that’s not working, that would be a bug. Otherwise, I think maybe the misunderstanding here is that the way this all composes.

I’m not sure that the design allows for any indirection on our part between the resource parameter value and the client_id of the resource server. In theory they don’t have to be the same, but I suspect in practice they do. I will check that, since I definitely was the original author of that code on the token endpoint.

Assuming that’s the case, the documentation issue may just be highlighting that fact.

What you originally mentioned about the audience metadata…that’s not a special requirement, it’s literally just how the ability to issue tokens to resource servers works. That’s needed to allow the issuance at all. If you didn’t do that, the token issued wouldn’t be usable by that third server at all by design. Maybe that’s the part being overlooked. But the client_id question is still open in my mind, I’ll need to check.

( https://shibboleth.atlassian.net/browse/JOIDC-155#add-comment?atlOrigin=eyJpIjoiNzU3OTNiNDViMDdhNDBjYzgxYWZmMmYwMDM5ZDY5ZTkiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-155#add-comment?atlOrigin=eyJpIjoiNzU3OTNiNDViMDdhNDBjYzgxYWZmMmYwMDM5ZDY5ZTkiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:7f918b6 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/2dbf1dc0/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d42d3fb4-bcb0-41d0-a326-a89465a2e6b2
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/2dbf1dc0/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-cc00572b-5ce2-4e1c-a204-03696f17e65a
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/2dbf1dc0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-3c3189f0-de05-40eb-8a8d-8ccb18cedc63
Type: image/png
Size: 296 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230505/2dbf1dc0/attachment-0005.png>