Experience with OIDC plugin

[Cantor, Scott]

On 11/18/18, 11:37 AM, "dev on behalf of Janne Lauros" <dev-bounces at shibboleth.net on behalf of janne.lauros at csc.fi> wrote:

> It seems I have understood this offline_access all wrong, sorry about that. I'll get my coat... I will dig to the bottom of
> it and fix it and report back.

I'm probably not taking the whole picture into consideration. I think I may be confusing the two back channel endpoints also. One of them is the one that accepts the authorization code (let's call it an artifact just so we're conceptually on the same page) and I think this one is that "other" one that can be used in similar fashion to a SAML AttributeQuery.

So if you imagine a rule for queries that said "must prove presence", the question would arise: what does that even mean given that obviously the user isn't actually present, but may be "proximate", or have recently "enough" logged in. It's pretty gray, but the way we did that in SAML was to equate the use of a transient subject ID with "proving presence".

I think that one could arguably accomplish the spirit of the requirement by controlling under what conditions you issue a token usable at that user_info endpoint and how long it's good for, and that can be done without actually checking for the session in real time. It's not an absolute proof but neither is the session. A session might last for days, so you'd have to be basing it on the timestamp anyway and deciding what was "recent enough".

-- Scott