[Ext] Re: use of JWT and / or STS with Shibboleth IDP?

[Bryan Wooten]

I find it interesting that both the CAS user list and the Shib list are both talking about JWT at the same time.

And I have devs asking me about CAS and JWT (internally we are CAS shop).

Frankly the whole SSO world is fragmented, so many solutions to the same problem, muddled by client side javascript, big players like google and microsoft and all that old legacy stuff (custom and commercial).

Then we throw in MFA / 2FA.

Anyway, is JWT a fad or a serious contender?

-Bryan

From: <Klingenstein>, Nate <nklingenstein at calstate.edu<mailto:nklingenstein at calstate.edu>>
Reply-To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thursday, October 6, 2016 at 2:50 PM
To: "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: [Ext] Re: use of JWT and / or STS with Shibboleth IDP?

Nate - you said you had reservations about JWT.  Can you share your thinking?  It can be out of band if you'd rather.

This is not deeply uninformed, but I've gone down in writing with worse.

Things I don't like:

A)  3-character fields in the tokens themselves
B)  Base 64 encoding with a special character delimiter(the period . ) and fixed "A.B.C" without any indication about what A, B, or C is, or any way to change it

https://scotch.io/tutorials/the-anatomy-of-a-json-web-token

C)  If you're using OAuth, why not just use the built-in bearer tokens?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161006/5da1d609/attachment-0001.html>