GEANT OIDC plugin

[Liam Hoekenga]

I've been testing the GEANT OIDC plugin for several months now.  We're
using  IDP 3.3.3, Tomcat 8.5 and Oracle Java 8.   We're using a check out
from HEAD that still supports IDP 3.3.  We don't have all of the latest
stuff, but it works well and have been able to resolve most of our
issues.  Janne
and Henri have been very responsive when we've had questions or requests.

Our testing has helped us identify some poorly behaved clients.  We've had
a number of RPs that expect the default authentication method for the
endpoints to be POST.  We know that most of our RPs (or rather their
service owners) want the user's principal sent as the sub value.

I'd be happy to share our experience if anyone has questions.

Liam

On Tue, Sep 11, 2018 at 1:19 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> Leaving aside the actual value put into the sub claim, you won't need any
> dedicated service to handle the pairwise or sector-wise IDs, I added that
> into the code just now.
>
> Just populate the sector ID from OIDC into AttributeResolutionContext.attributeRecipientGroupID
> and the computed/stored plugins will do the right thing.
>
> This also opens up options for other resolver behavior or filtering
> plugins to operate based on the sector ID (I probably need to add this to
> the filter context too, I'll do that now).
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180911/6a5a4dcb/attachment-0001.html>