Docs on client_credentials grant support

[Philip Smart]

> On 23 Feb 2022, at 20:48, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> The OP plugin docs are updated with most of (my) new additions, primarily the new client authentication changes [1] and the client_credentials/JWT support [2].
>
> With reagard to the latter, about the only config question I'm chewing on is whether JWT encryption should be optional by default, or require manually allowing. OIDC leaves it optional by default but that was a) maybe not a super choice but b) kind of defensible because the tokens are meant only for the client and usually pulled over TLS).
>
> This grant is not at all like that, so any custom claims would be exposed to the client that really doesn't need to see them, and potentially exposed over other insecure channels out of the OP's control. Our usual practice is to encrypt by default and require intervention to make that optional, so I changed the default to follow that, but it does mean the support for unverified/unregistered resource servers always has an extra step of applying that setting change too, which is a little awkward.

FWIW. I think keeping the claims confidential by default is a good thing. In addition to possibly exposing sensitive/PI information it stops the client from trying to introspect and use the claims for whatever reason that may eventually break. Or at least says, ’This is not for you’.

So (for my understanding) this means by default the resources servers would need to be registered, and any you want to allow unregistered would require an override which disables encryption? So for either type you need some form of registration even if basic.

Phil

>
> -- Scott
>
> [1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930409507/OPClientAuthentication
> [2] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930606124/OPClientCredentialsGrant
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice