openid plugin and attributes

[Paul Hethmon]

> On May 3, 2016, at 4:00 PM, Paul Hethmon <paul.hethmon at clareitysecurity.com> wrote:
> 
>> 2) OIDC requires direct, non-browser, communication between RP and IP.  A lot of Shib IdPs run without activating attribute query and such as it allows for easier clustering.  Does your plug-in use shib's state sharing mechanism?  If so, can it be activated only for OIDC accesses?
> 
> I’m piggy backing on my v2 db storage service. I have extended it to have direct support for storing OIDC sessions. With the direct back channel model of OIDC, I just didn’t see a way to support it without clustering the sessions.

Another thing this led to is NOT supporting dynamic registration. Supporting that would require a mechanism to create and persist the RP information across all servers in a farm.

So you will have to create and register your client IDs out of band.

Paul

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com