use of JWT and / or STS with Shibboleth IDP?

[Cantor, Scott]

> Trying again: I just use RFC 6751 if I want a barebones implementation of RFC
> 6749.  If I wanted more, I would use SAML tokens because the fields are
> more than 3 bytes long and it doesn't rely on an arbitrary delimiter and fixed
> A.B.C convention.

I think you mean 6750, but yes, if you don't need a standard token format, then, well, you don't.  That's most non-OIDC uses of OAuth.

Obviously all those are features to the people who created JWT, and JWT is the standard JSON format security token. Nothing is going to replace it any time soon until JSON itself is (hope it's before I retire, but there's not enough popcorn in the world).

> This is the same marginally informed answer I gave others.  If a developer
> wants to use it with a compelling reason, I'm fine with it.  I just haven't heard
> that reason yet.

OIDC is certainly one. The others are architectural. If you desire a separation between token issuance and token processing (i.e. no callbacks), that's what you've got. You're not convincing people to use SAML there, that ship has sailed.

But I agree very much that the dominant usage is opaque tokens and callbacks, and a lot of that spec work is going to go to waste.
 
-- Scott