GEANT OIDC plugin

[Henri Mikkonen]

On 10/09/2018 18.54, Jim Fox wrote:
>>>> As far as I can tell it only supports implicit flow.  At least 
>>>> that's all my instance supports.
>>
>> All response types are supported. Having only implicit flow may be 
>> result of misconfiguration or missing something in the installation 
>> like token and userinfo endpoints.
> 
> I expected as much.  My openid-configuration has
> 
>     "grant_types_supported":[
>        "authorization_code",
>        "implicit",
>        "refresh_token"
>     ],
> 
> But I didn't see how to configure the replying party for that.  Nor how 
> to configure replying party credentials.  Maybe you could point me to 
> some documentation for those.

You're right, the documentation is currently very limited. The (JSON) 
file structure to set up static trust relationship between the OP and RP 
is shown here:

https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/MetadataConfiguration#filesystemclientinformationresolver

That example only shows 4 different configuration values, but the plugin 
understands most of the values defined in the OIDC dynamic client 
registration spec:

https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata

https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse

So, you can set up the client secret "secret123" and grant type 
"authorization_code" for RP by adding the following to the JSON file for RP:

...
"client_secret" : "secret123",
"grant_types" : ["authorization_code"],
...

We'll work on the documentation before next release. In the meantime 
feel free to ask any questions here.

BR,
Henri.