Experience with OIDC plugin

[Tom Scavo]

On Sat, Nov 17, 2018 at 10:52 AM Janne Lauros <janne.lauros at csc.fi> wrote:
>
>  The extension does not validate the issuer value against any schema. Maybe it should. Not following the specification on the issuer value will lead to problems latest at when applying discovery specification, https://openid.net/specs/openid-connect-discovery-1_0.html. There the issuer value is used to resolve the location of the openid configuration,.

We've spent years helping deployers understand that the entityID is a
name, not a location. It would be a shame to reverse that trend now.

Perhaps the 'iss' claim could be derived from the endpoint locations?
Just a thought...

Tom