GEANT OIDC plugin

[Tom Scavo]

On Mon, Sep 10, 2018 at 10:28 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>I know OIDC sub claims aren't explicitly scoped but I don't think there's any rule saying they can't be.

That's an interesting idea. A sub claim value is any ASCII string
(<=255 chars) so stuffing a scoped attribute in there is possible, I
guess. The problem is that sub claim values are defined to be case
sensitive.

More interestingly, OIDC has a slight twist on pairwise identifiers
(see section 8 of OIDC Core):

- No allowance is made for stored IDs.
- A computed ID depends on the client's Sector Identifier
(sector_identifier_uri), which is a URL.
- The host component of the sector_identifier_uri is used in the computation.

That last bit diverges from the Shibboleth approach. In any case, a
Sector Identifier sure sounds like an entityID to me.

Tom