Experience with OIDC plugin

[Janne Lauros]

Hi!

>> iIn what sense is 'issuer' not the entityID of the issuer? 

 There are two different properties. 'idp.oidc.issuer' for setting Issuer Identifier for OIDC and then you have of course the one for  SAML2 entityID. OIDC sets different requirements for issuer than SAML2 does for entity id:

"Issuer Identifier
    Verifiable Identifier for an Issuer. An Issuer Identifier is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. "

  This would of course clash with existing SAML2 deployments.

>> I have to set 'issuer' to be my IdP's entityID or else nothing works.

 That suggests there is something funny in your installation or in our beta release. What does nothing works mean in this context?

 Br Janne

----- Original Message -----
From: "Jim Fox" <fox at washington.edu>
To: "dev" <dev at shibboleth.net>
Sent: Monday, 19 November, 2018 07:26:35
Subject: Re: Experience with OIDC plugin

iIn what sense is 'issuer' not the entityID of the issuer? 
I have to set 'issuer' to be my IdP's entityID or else nothing works.
Also, as I read the spec, "Issuer discovery is OPTIONAL;"

Jim

On Sat, 17 Nov 2018, Janne Lauros wrote:

> Date: Sat, 17 Nov 2018 16:51:47 +0000
> From: Janne Lauros <janne.lauros at csc.fi>
> Reply-To: Shib Dev <dev at shibboleth.net>
> To: dev <dev at shibboleth.net>
> Subject: Re: Experience with OIDC plugin
> 
>
> The extension does not use entityID as issuer. It uses value set with property 'idp.oidc.issuer'. I hope that helps.
>
> BR Janne
>
> ----- Original Message -----
> From: "Tom Scavo" <trscavo at gmail.com>
> To: "dev" <dev at shibboleth.net>
> Sent: Saturday, 17 November, 2018 18:04:58
> Subject: Re: Experience with OIDC plugin
>
> On Sat, Nov 17, 2018 at 10:52 AM Janne Lauros <janne.lauros at csc.fi> wrote:
>>
>>  The extension does not validate the issuer value against any schema. Maybe it should. Not following the specification on the issuer value will lead to problems latest at when applying discovery specification, https://openid.net/specs/openid-connect-discovery-1_0.html. There the issuer value is used to resolve the location of the openid configuration,.
>
> We've spent years helping deployers understand that the entityID is a
> name, not a location. It would be a shame to reverse that trend now.
>
> Perhaps the 'iss' claim could be derived from the endpoint locations?
> Just a thought...
>
> Tom
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>
-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net