Experience with OIDC plugin

[Janne Lauros]

Hi!

 It seems I have understood this offline_access all wrong, sorry about that. I'll get my coat... I will dig to the bottom of it and fix it and report back.

 BR Janne

----- Original Message -----
From: "Janne Lauros" <janne.lauros at csc.fi>
To: "dev" <dev at shibboleth.net>
Sent: Sunday, 18 November, 2018 17:35:38
Subject: Re: Experience with OIDC plugin

>Shouldn't they be just be short lived and assumed to be issued with a user having logged in to produce them?

 I had to revisit the specification. The way I read chapter 11. about offline_access scope the presence of the user must be checked when accessing UserInfo endpoint unless offline_access scope has been requested. I guess there is no way around it. I will ask about it. That leaves still open if we achieve that (or anything) by trying to locate the session id of the authenticated user at that point.


    "offline_access
        OPTIONAL. This scope value requests that an OAuth 2.0 Refresh Token be issued that can be used to obtain an Access Token that grants access to the End-User's UserInfo Endpoint even when the End-User is not present (not logged in)."

 BR Janne 

 
-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net