Experience with OIDC plugin

[Jim Fox]

iIn what sense is 'issuer' not the entityID of the issuer? 
I have to set 'issuer' to be my IdP's entityID or else nothing works.
Also, as I read the spec, "Issuer discovery is OPTIONAL;"

Jim

On Sat, 17 Nov 2018, Janne Lauros wrote:

> Date: Sat, 17 Nov 2018 16:51:47 +0000
> From: Janne Lauros <janne.lauros at csc.fi>
> Reply-To: Shib Dev <dev at shibboleth.net>
> To: dev <dev at shibboleth.net>
> Subject: Re: Experience with OIDC plugin
> 
>
> The extension does not use entityID as issuer. It uses value set with property 'idp.oidc.issuer'. I hope that helps.
>
> BR Janne
>
> ----- Original Message -----
> From: "Tom Scavo" <trscavo at gmail.com>
> To: "dev" <dev at shibboleth.net>
> Sent: Saturday, 17 November, 2018 18:04:58
> Subject: Re: Experience with OIDC plugin
>
> On Sat, Nov 17, 2018 at 10:52 AM Janne Lauros <janne.lauros at csc.fi> wrote:
>>
>>  The extension does not validate the issuer value against any schema. Maybe it should. Not following the specification on the issuer value will lead to problems latest at when applying discovery specification, https://openid.net/specs/openid-connect-discovery-1_0.html. There the issuer value is used to resolve the location of the openid configuration,.
>
> We've spent years helping deployers understand that the entityID is a
> name, not a location. It would be a shame to reverse that trend now.
>
> Perhaps the 'iss' claim could be derived from the endpoint locations?
> Just a thought...
>
> Tom
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>