openid plugin and attributes

[Jim Fox]

>> I’m close to finishing up my OpenID Connect plug-in for Shib and have some choices relating to releasing attributes. My philosophy has been to maintain minimal configuration for OpenID, instead pulling what I can from the Shib configuration. So one thought on managing attribute release is to represent each OIDC RP as a SAML RP. So from a configuration viewpoint, you would add a metadata file for each OIDC RP and configure attribute release as normal. The OIDC plugin would request authentication as that SAML RP when it received the corresponding OIDC authentication request. The win would be the Shib attribute engine controlling the attribute release. The loss would be maintaining a fake/proxy metadata file for each OIDC RP.
>>
>> Thoughts? Am I going to far down this path of relying on Shib configuration?
>>

1) OIDC requires some extra data about client RPs, e.g. client ID (usually a uuid of some sort).  Would these fit into SAML metadata?

2) OIDC requires direct, non-browser, communication between RP and IP.  A lot of Shib IdPs run without activating attribute query and such as it allows for easier clustering.  Does your plug-in use shib's state sharing mechanism?  If so, can it be activated only for OIDC accesses?

Jim