[JIRA] (JOIDC-155) Documentation lacks clear description of interaction between introspection and audience

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-155 ( https://shibboleth.atlassian.net/browse/JOIDC-155?atlOrigin=eyJpIjoiNWM1ZTY0ZDNkZTdkNDY1N2I1NDEwNzcxODhhNGU4OTUiLCJwIjoiaiJ9 )

Re: Documentation lacks clear description of interaction between introspection and audience ( https://shibboleth.atlassian.net/browse/JOIDC-155?atlOrigin=eyJpIjoiNWM1ZTY0ZDNkZTdkNDY1N2I1NDEwNzcxODhhNGU4OTUiLCJwIjoiaiJ9 )

The way it works is that if you’re not issuing an ID token (i.e. it’s pure OAuth), it will default in the first audience allowed. When the openid scope is involved, it doesn’t do that because the normal default in that case is to issue the token for the OP’s use only.

So it only works as a workaround in a subset of cases. I would agree it probably would be useful to allow that defaulting in other cases, but the root of the problem is really the lack of indirection anyway. But that will take a lot of work to fix. You should assume that client_ids in our implementation are meant to be URIs and that doing otherwise will always lead to limitations.

( https://shibboleth.atlassian.net/browse/JOIDC-155#add-comment?atlOrigin=eyJpIjoiNWM1ZTY0ZDNkZTdkNDY1N2I1NDEwNzcxODhhNGU4OTUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-155#add-comment?atlOrigin=eyJpIjoiNWM1ZTY0ZDNkZTdkNDY1N2I1NDEwNzcxODhhNGU4OTUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:b79b7f6 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230509/a7f2dabb/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-c813c5de-ea14-45eb-8256-a71a000f29e7
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230509/a7f2dabb/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f88931b2-7853-446a-8325-9824c95a2010
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230509/a7f2dabb/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-37682aa1-5b17-473c-be66-9274528b75a8
Type: image/png
Size: 296 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230509/a7f2dabb/attachment-0005.png>