IdP support for Open Auth?

[Klingenstein, Nate]

The OIDC add-on that we had written for Shib also provides OAuth2.0 support.

Even better, but I assume this uses the real storage service and thus makes the IdP stateful, yes?  A shim would allow you to make only that piece stateful.

It's a defensible trade-off in either direction.

Regardless, the two big caveats:

A)  Over time, this will effectively turn that hostname into an entityID unless their OAuth 2.0 implementation(and any others that come along) supports metadata or discovery.  I have a hunch.
B)  This is reintroducing the back channel unless you come up with a way to encode nodes into the OAuth tokens and teach a reverse proxy how to read them.  There is, AFAIK, no standard way to do that.  It's on my wishlist for OAuth, CAS, and more.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160922/b2594d80/attachment.html>