Experience with OIDC plugin

[Janne Lauros]

Hi Jim,

 I forgot to answer the issuer value. The extension does not validate the issuer value against any schema. Maybe it should. Not following the specification on the issuer value will lead to problems latest at when applying discovery specification, https://openid.net/specs/openid-connect-discovery-1_0.html. There the issuer value is used to resolve the location of the openid configuration,.

 BR Janne 

----- Original Message -----
From: "Jim Fox" <fox at washington.edu>
To: "dev" <dev at shibboleth.net>
Sent: Friday, 16 November, 2018 23:55:42
Subject: Experience with OIDC plugin

( summarized repost from the shib users list )

This is a first look at the beta oidc extension.

The instructions were easy to follow.

One thing regarding the issuer setting in idp-oidc.properties:  Instructions say it has to be https scheme, host, .. However, my dev idp has an
entity id of "urn:mace:incommon:washington.edu:dev".  This seemd to work ok.

Shib default (I think) is cookie sessions.  The extension requires memory (1 host) or some sort of shared, server-side session.  Don't know how easy t
hat'll be for most sites.

Attribute filtering seems a bit sketchy.

If I set this

     <AttributeFilterPolicy id="OPENID_SCOPE_EMAIL">
         <PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="email" />
         <AttributeRule attributeID="email">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>

I see email being released on the initial login (shows in the audit log), however when the SP hits the userinfo endpoint email is not released. To
get email released at userinfo I also need this filter policy

     <AttributeFilterPolicy id="OPENID_urizen">
         PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="urizen"/>
         <AttributeRule attributeID="email">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>

So at userinfo it seems that filtering is on the SP's entityID; while at the user's login it is on the scopes.

Don't know if that's how it's supposed to go.

Jim

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net