Experience with OIDC plugin

[Janne Lauros]

Hi!
  
  I would be happy to get rid of that "verification" step. What we actually do in that step is to verify the session of the authenticated user still exists, that counts as presence for us. If there is better solution or argument it does not count I am happy to remove it. I'll have to verify from people who know oidc better than me what losing that step means. 

 BR Janne

----- Original Message -----
From: "Scott Cantor" <cantor.2 at osu.edu>
To: "dev" <dev at shibboleth.net>
Sent: Saturday, 17 November, 2018 23:12:07
Subject: RE: Experience with OIDC plugin

>  First about the session storage. When accessing UserInfo endpoint OIDC
> expects for OP to verify user presence unless request has offline_access scope.
> The extension does it by verifying user session still exists.

I don't think you can prove presence on the back channel, and isn't the only way to get one of these codes on the front channel to have done authentication or SSO? Shouldn't they be just be short lived and assumed to be issued with a user having logged in to produce them?

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net