Super-dumb question about IdP + AuthZ

[Cantor, Scott]

> By authz I mean whatever OpenID Connect as the authn layer on top of
> OAuth 2 needs. But I don’t really understand what I’m talking about.

Ultimately it's just the same as SAML, it's issuing tokens to authenticate a system to another system with various additional features on top for scoping that token, limiting its use, and attaching additional data to the token. Again, just like SAML.

The problem with understanding anything like that in isolation is that you can't. You need a grounded use case and profile to articulate exactly what has to be done and what the risks and mitigations are. When you skip that step, you have a non-interoperable erector set of pieces that somebody has to construct a solution from. OIDC is one such use case.

> I looked at the SP wiki, but I don’t see you use the word authorization,
> instead I see “protect content”. I’m wondering if IdP+OIDC needs parts of
> what you’ve built for the SP.

I doubt it formally does for the parts it is trying to support, at least not to any different degree than we do now to support e.g. proxying because we have never attempted to provide a two-sided system serving both roles at once. Of course it may well be desirable and even practical to do that.

-- Scott