[Ext] Re: use of JWT and / or STS with Shibboleth IDP?

[Cantor, Scott]

> Anyway, is JWT a fad or a serious contender?

OIDC is based on it at least minimally, so it's not going anywhere. I don't think it has a ton of traction outside of that space because people don't really want to parse tokens, they want to hand out blobs and have services perform validation callbacks, so the token is only parsed by the system that issued it. That eliminates a big source of interop concerns, versioning, etc. Data itself gets pushed out through the properietary APIs that the tokens protect.

-- Scott