Testing new OAuth features

[Wessel, Keith]

Out of curiosity, Scott, is this what you were referring to yesterday on the users list when you said " I think it makes much more sense to just allow for unregistered clients using client authentication against LDAP or something along those lines"?

Keith


-----Original Message-----
From: dev <dev-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, March 2, 2022 8:53 AM
To: Shib Dev <dev at shibboleth.net>
Subject: Testing new OAuth features

I'm sending this to dev mostly to relay it to a specific interested party that may want to test this code, but obviously any testing is welcome at this point.

Testing this involves 3 snapshots that will go final at roughly the same point, the IdP, the "OIDC commons" update, and the plugin itself. The dated nightly builds are below, you just want to grab the latest from the previous night's builds.

https://urldefense.com/v3/__https://build.shibboleth.net/maven/snapshots/net/shibboleth/idp/idp-distribution/4.2.0-SNAPSHOT/__;!!DZ3fjg!oxMmcle1lPBeHaB5evlHBietAcC0OzVoA3x4RDwLA0DsGKwvJ0EVdy_hLOzHlq3-LQ$ 

https://urldefense.com/v3/__https://build.shibboleth.net/maven/snapshots/net/shibboleth/oidc/oidc-common-dist/1.2.0-SNAPSHOT/__;!!DZ3fjg!oxMmcle1lPBeHaB5evlHBietAcC0OzVoA3x4RDwLA0DsGKwvJ0EVdy_hLOzutgMVHg$ 

https://urldefense.com/v3/__https://build.shibboleth.net/maven/snapshots/net/shibboleth/idp/plugin/oidc/idp-plugin-oidc-op-distribution/3.1.0-SNAPSHOT/__;!!DZ3fjg!oxMmcle1lPBeHaB5evlHBietAcC0OzVoA3x4RDwLA0DsGKwvJ0EVdy_hLOx0oDnTzw$ 

We're not frozen but a breaking change at this point is probably going to be rare. I would not install any of this over top of a "real" system, obviously, mainly because the plugins will make things messy and getting it updated to final may be tricky.

Docs for the new OAuth features are mainly:
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930606124/OPClientCredentialsGrant__;!!DZ3fjg!oxMmcle1lPBeHaB5evlHBietAcC0OzVoA3x4RDwLA0DsGKwvJ0EVdy_hLOyXkX2Wng$ 
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2930409507/OPClientAuthentication__;!!DZ3fjg!oxMmcle1lPBeHaB5evlHBietAcC0OzVoA3x4RDwLA0DsGKwvJ0EVdy_hLOwG7kC7gg$ 

The new OAUTH2.Token and OAUTH2.TokenAudience relying party profile beans activate the new features and are also now documented.

The IdP installs normally, bin/install.sh

The plugins are more complex because they have to be signed, and you have to do that yourself prior to a release with a PGP key and then point the plugin installer at the key.

On any box with GPG installed, it's simple to get a quick key created for testing if necessary:
$ gpg --quick-generate-key userid
$ gpg -a --export userid > PUBKEY

Assuming you had a PGP key, you just sign the distributions with:
$ gpg -a -b <filename>

And install them with:
$ bin/plugin.sh -i <filename> --truststore <path to GPG pub key file> -noCheck

I'm happy to guide any testers or address any issues on the dev list.

-- Scott


-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net