<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi Tom,</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">How to add RPs?<br class=""><br class="">1. File system via JSON<br class=""><br class="">- The implementation is very similar to Shib’s metadata resolvers, but we<br class="">needed to fork the whole (abstract) class hierarchy from the root as the<br class="">existing were based on SAML EntityDescriptors.<br class=""></blockquote><br class="">Instead of rewriting the metadata resolvers from scratch, did you<br class="">consider extending SAML metadata by creating a subtype of the<br class="">md:RoleDescriptorType type? Since SAML metadata is extensible, it<br class="">should be possible to create an extension that meets your<br class="">requirements. FWIW, I would call it md:APSSODescriptor where AP stands<br class="">for "Application Provider.”</div></div></blockquote><div><br class=""></div><div><div style="font-family: HelveticaNeue;" class="">No, we didn’t really consider that yet. The current way was very straightforward to implement as we could duplicate the structure from SAML metadata resolvers: we just use Nimbus’s OIDCClientInformation in the place of EntityDescriptor. The downside is that there’re now duplicate logic and code lines with these two types of resolvers. That should be avoided, we know.</div><div style="font-family: HelveticaNeue;" class=""><br class=""></div><div style="font-family: HelveticaNeue;" class="">One way to avoid that would be do use approach like you propose (if I understood it correctly). Another way would require modifications from OpenSAML: if their abstract classes wouldn’t define EntityDescriptor so early in the inheritance chain, then also other types/formats could exploit the same classes.</div><div style="font-family: HelveticaNeue;" class=""><br class=""></div><div style="font-family: HelveticaNeue;" class="">We’re open to rewrite our code if needed and adapt to whatever approach is agreed for instance on this forum. This subject needs more work from our side in any case.</div></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">2. Dynamic registration,<br class=""><a href="https://openid.net/specs/openid-connect-registration-1_0.html" class="">https://openid.net/specs/openid-connect-registration-1_0.html</a><br class=""><br class="">- The registered RPs are stored & obtained via StorageService (still on<br class="">PoC-phase), seems to be compatible with Shib’s in-memory and JPA services.<br class=""><br class="">- OIDCfed (spec by Roland Hedberg et al.) compatibility under construction<br class="">now, need to be in testable shape before end of November:<br class="">https://wiki.geant.org/display/gn42jra3/OIDCfed+Hackathon<br class=""></blockquote><br class="">The latter doesn't have any useful content so I'm not sure I<br class="">understand the point you're trying to make.</div></div></blockquote><div><br class=""></div><div><font face="HelveticaNeue" class="">As we’re participating to that Hackathon event, our Shib OP needs to be in such a shape that the participating fed-aware RPs can exploit it in testing. By fed-aware I mean compatibility to Roland’s specifications. Roland is doing that work as a part of the same GEANT task with us, so that’s why we’re also focusing on that.</font></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">In any case, just today<br class="">the OpenID Foundation published FastFed 1.0:<br class=""><a href="http://openid.net/specs/fastfed-1_0-00.html" class="">http://openid.net/specs/fastfed-1_0-00.html</a><br class=""><br class="">I don't know if that's relevant (I'm still trying to get my head<br class="">around FastFed) but I thought I'd mention it just in case.</div></div></blockquote><br class=""></div><div><span style="font-family: HelveticaNeue;" class="">I don’t know much about FastFed as we don’t have funding to implement that at the moment.</span></div><div><span style="font-family: HelveticaNeue;" class=""><br class=""></span></div><div><span style="font-family: HelveticaNeue;" class="">BR,</span></div><div><span style="font-family: HelveticaNeue;" class="">Henri.</span></div></body></html>