OIDCIdTokenContext?

[Scott Koranda]

On Fri, Dec 11, 2015 at 2:36 PM, Marvin Addison <marvin.addison at gmail.com>
wrote:

> In the meantime I just went ahead and wrote GoogleIdPrincipal,
>> GoogleIdTokenContext, ExtractGoogleIdTokenFromFormRequest,
>> and ValidateGoogleIdToken classes.
>
>
> I'm interested in ValidateGoogleIdToken. Are you explicitly configuring
> the public key used to validate the token signature? Or is there a metadata
> source involved?
>

There is where focusing just on Google at this time makes things simpler.
There is a Google API client library for validating ID tokens sent by
Google. It makes that part quite simple. See

 https://developers.google.com/identity/sign-in/web/backend-auth

The more general problem would be much more interesting but I need to learn
more about how the OIDC community thinks the keys will be made available in
secure and scalable ways.

Thanks,

Scott K
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151214/18b3f073/attachment.html>