Testing new OAuth features
Cantor, Scott
cantor.2 at osu.edu
Wed Mar 2 14:53:07 UTC 2022
I'm sending this to dev mostly to relay it to a specific interested party that may want to test this code, but obviously any testing is welcome at this point.
Testing this involves 3 snapshots that will go final at roughly the same point, the IdP, the "OIDC commons" update, and the plugin itself. The dated nightly builds are below, you just want to grab the latest from the previous night's builds.
https://build.shibboleth.net/maven/snapshots/net/shibboleth/idp/idp-distribution/4.2.0-SNAPSHOT/
https://build.shibboleth.net/maven/snapshots/net/shibboleth/oidc/oidc-common-dist/1.2.0-SNAPSHOT/
https://build.shibboleth.net/maven/snapshots/net/shibboleth/idp/plugin/oidc/idp-plugin-oidc-op-distribution/3.1.0-SNAPSHOT/
We're not frozen but a breaking change at this point is probably going to be rare. I would not install any of this over top of a "real" system, obviously, mainly because the plugins will make things messy and getting it updated to final may be tricky.
Docs for the new OAuth features are mainly:
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930606124/OPClientCredentialsGrant
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930409507/OPClientAuthentication
The new OAUTH2.Token and OAUTH2.TokenAudience relying party profile beans activate the new features and are also now documented.
The IdP installs normally, bin/install.sh
The plugins are more complex because they have to be signed, and you have to do that yourself prior to a release with a PGP key and then point the plugin installer at the key.
On any box with GPG installed, it's simple to get a quick key created for testing if necessary:
$ gpg --quick-generate-key userid
$ gpg -a --export userid > PUBKEY
Assuming you had a PGP key, you just sign the distributions with:
$ gpg -a -b <filename>
And install them with:
$ bin/plugin.sh -i <filename> --truststore <path to GPG pub key file> -noCheck
I'm happy to guide any testers or address any issues on the dev list.
-- Scott
More information about the dev
mailing list