GEANT OIDC plugin

[Janne Lauros]

Hi!

 There are also few other claims than sub that get special treatment and are not (currently) meant to be resolved by attribute resolver. 

 https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/SpecialClaims.

 They are all ultimately all just claims and same question arises for them too. What is common to them is that specification controls both their content and whether they should exist or not. They are not your "normal user claims". This does not of course mean they could not be resolved by attribute resolver if this was revisited this in mind.   

 Br Janne

----- Original Message -----
From: "Scott Cantor" <cantor.2 at osu.edu>
To: "dev" <dev at shibboleth.net>
Sent: Monday, 10 September, 2018 15:59:14
Subject: Re: GEANT OIDC plugin

> Subject is generated by the same mechanisms as SAML2 nameid is generated with. The configuration is of course 
> separate from SAML2 but the principle is the same.

I think design-wise we're all still chewing on that question. Since ultimately this is still a "claim", and thus an Attribute, I think a case could be made to move that back into the AttributeResolver and handle it like any other attribute in the OIDC space, but just encode it from a Computed/Stored-backed AttributeDefinition, which is the same thing we'll have to do for the pairwise-id SAML Attribute.

-- Scott


-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net