<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
July 31.<br>
<br>
<a class="moz-txt-link-freetext" href="http://shibboleth.net/pipermail/announce/2015-May/000112.html">http://shibboleth.net/pipermail/announce/2015-May/000112.html</a><br>
<br>
<br>
<div class="moz-cite-prefix">On 5/3/16 5:18 PM, Jim Fox wrote:<br>
</div>
<blockquote cite="mid:alpine.DEB.2.10.1605031417530.28139@x315"
type="cite">
<br>
v2? isn't v2's end-of-life right about now?
<br>
<br>
Jim
<br>
<br>
<br>
On Tue, 3 May 2016, Paul Hethmon wrote:
<br>
<br>
<blockquote type="cite">Date: Tue, 3 May 2016 13:00:27
<br>
From: Paul Hethmon <a class="moz-txt-link-rfc2396E" href="mailto:paul.hethmon@clareitysecurity.com"><paul.hethmon@clareitysecurity.com></a>
<br>
To: Shibboleth Dev <a class="moz-txt-link-rfc2396E" href="mailto:dev@shibboleth.net"><dev@shibboleth.net></a>
<br>
Reply-To: Shib Dev <a class="moz-txt-link-rfc2396E" href="mailto:dev@shibboleth.net"><dev@shibboleth.net></a>
<br>
Subject: Re: openid plugin and attributes
<br>
<br>
<br>
<blockquote type="cite">On May 3, 2016, at 2:04 PM, Jim Fox
<a class="moz-txt-link-rfc2396E" href="mailto:fox@washington.edu"><fox@washington.edu></a> wrote:
<br>
<br>
1) OIDC requires some extra data about client RPs, e.g. client
ID (usually a uuid of some sort). Would these fit into SAML
metadata?
<br>
</blockquote>
<br>
I couldn’t find a good way to fit the OIDC “metadata” (very
loose term there) into SAML metadata. So there are some
additions to the core Shib configuration files (internal.xml,
handler.xml) to bootstrap the OIDC components. At that point,
the OIDC configuration manager reads some JSON formatted files
for core configuration data and for RP information. However, the
client ID and client secret/password I modeled as a simple BASIC
authentication method. For my IdP’s, I run a BASIC auth filter
for ECP purposes and simply used it to protect that endpoint. So
whatever method you use to protect it will work.
<br>
<br>
<blockquote type="cite">
<br>
2) OIDC requires direct, non-browser, communication between RP
and IP. A lot of Shib IdPs run without activating attribute
query and such as it allows for easier clustering. Does your
plug-in use shib's state sharing mechanism? If so, can it be
activated only for OIDC accesses?
<br>
</blockquote>
<br>
I’m piggy backing on my v2 db storage service. I have extended
it to have direct support for storing OIDC sessions. With the
direct back channel model of OIDC, I just didn’t see a way to
support it without clustering the sessions.
<br>
<br>
cheers,
<br>
<br>
Paul
<br>
<br>
-----
<br>
Paul Hethmon
<br>
Chief Software Architect
<br>
<a class="moz-txt-link-abbreviated" href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a>
<br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>