IdP support for Open Auth?

[David Langenberg]

Correct. It is stateful and requires a back end storage.

Dave

David Langenberg
Asst. Director, Identity Management
The University of Chicago
Sent from my iPhone

On Sep 21, 2016, at 9:14 PM, Klingenstein, Nate <nklingenstein at calstate.edu<mailto:nklingenstein at calstate.edu>> wrote:

The OIDC add-on that we had written for Shib also provides OAuth2.0 support.

Even better, but I assume this uses the real storage service and thus makes the IdP stateful, yes?  A shim would allow you to make only that piece stateful.

It's a defensible trade-off in either direction.

Regardless, the two big caveats:

A)  Over time, this will effectively turn that hostname into an entityID unless their OAuth 2.0 implementation(and any others that come along) supports metadata or discovery.  I have a hunch.
B)  This is reintroducing the back channel unless you come up with a way to encode nodes into the OAuth tokens and teach a reverse proxy how to read them.  There is, AFAIK, no standard way to do that.  It's on my wishlist for OAuth, CAS, and more.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160922/6a1a6c61/attachment.html>