is OpenID Connect on the roadmap?

[Peter Schober]

* Tom Scavo <trscavo at gmail.com> [2012-11-01 00:49]:
> I realize the Shib dev team is sorta rebuilding right now but I
> thought I'd bring this up anyway. Are there plans to add OpenID
> Connect to the list of protocols supported by the IdP? It would be
> much easier to introduce OpenID Connect in the InCommon Federation if
> the IdP supported it natively.

(Ignoring for the moment that the OpenID Connect spec isn't even
finished, and is completely lacking anything remotely resembling the
trust framework we have today, as well as required attribute schemas.)

If support was there in the code today, how would that change anything
for InCommon? AFAIK there are still plenty of sites running Shib 1.x
who cannot even use SAML2.0 in 2012?

> A possible response might be: why implement OpenID Connect in the IdP
> first (if Shib supports it at all)? As is usually the case, it's a
> chicken-and-egg problem that kinda depends on how you look at it. My
> thought (today) is that if OpenID Connect succeeds, it will succeed at
> internal SSO before external SSO (which is exactly what we've seen
> happen with SAML).

Personally I doubt that "internal SSO" is a driver for OpenID Connect.
The only potential driver I see is for RPs to tie into the internet
monopolist IDPs and forget about "internal SSO" altogether (or
federation, for that matter).

So before there's evan a plan for support on a roadmap $people would
need to get together and come up with ways to bring the desired
characteristics of our currently popular trust model and attribute
schema to something else entirely.
-peter