openid plugin and attributes

[Paul Hethmon]

> On May 3, 2016, at 2:04 PM, Jim Fox <fox at washington.edu> wrote:
> 
> 1) OIDC requires some extra data about client RPs, e.g. client ID (usually a uuid of some sort).  Would these fit into SAML metadata?

I couldn’t find a good way to fit the OIDC “metadata” (very loose term there) into SAML metadata. So there are some additions to the core Shib configuration files (internal.xml, handler.xml) to bootstrap the OIDC components. At that point, the OIDC configuration manager reads some JSON formatted files for core configuration data and for RP information. However, the client ID and client secret/password I modeled as a simple BASIC authentication method. For my IdP’s, I run a BASIC auth filter for ECP purposes and simply used it to protect that endpoint. So whatever method you use to protect it will work.

> 
> 2) OIDC requires direct, non-browser, communication between RP and IP.  A lot of Shib IdPs run without activating attribute query and such as it allows for easier clustering.  Does your plug-in use shib's state sharing mechanism?  If so, can it be activated only for OIDC accesses?

I’m piggy backing on my v2 db storage service. I have extended it to have direct support for storing OIDC sessions. With the direct back channel model of OIDC, I just didn’t see a way to support it without clustering the sessions.

cheers,

Paul

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com