GEANT OIDC-work status

[Tom Scavo]

Hi Henri & Janne,

On Mon, Nov 13, 2017 at 9:31 AM, Henri Mikkonen <henri.mikkonen at csc.fi> wrote:
>
> How to add RPs?
>
> 1. File system via JSON
>
> - The implementation is very similar to Shib’s metadata resolvers, but we
> needed to fork the whole (abstract) class hierarchy from the root as the
> existing were based on SAML EntityDescriptors.

Instead of rewriting the metadata resolvers from scratch, did you
consider extending SAML metadata by creating a subtype of the
md:RoleDescriptorType type? Since SAML metadata is extensible, it
should be possible to create an extension that meets your
requirements. FWIW, I would call it md:APSSODescriptor where AP stands
for "Application Provider."

> 2. Dynamic registration,
> https://openid.net/specs/openid-connect-registration-1_0.html
>
> - The registered RPs are stored & obtained via StorageService (still on
> PoC-phase), seems to be compatible with Shib’s in-memory and JPA services.
>
> - OIDCfed (spec by Roland Hedberg et al.) compatibility under construction
> now, need to be in testable shape before end of November:
> https://wiki.geant.org/display/gn42jra3/OIDCfed+Hackathon

The latter doesn't have any useful content so I'm not sure I
understand the point you're trying to make. In any case, just today
the OpenID Foundation published FastFed 1.0:
http://openid.net/specs/fastfed-1_0-00.html

I don't know if that's relevant (I'm still trying to get my head
around FastFed) but I thought I'd mention it just in case.

Tom