Protecting my OIDC dynamic client registration endpoint in Tomcat

[Cantor, Scott]

I'm not sure the point of the whole model is to limit it, but far be it from me...

It seems to me one obvious thing is just to IP-limit it and use the endpoint as part of a different process for registration I guess.

>    THE OIDC extension doesn't yet seem to have any functionality built in for somehow protecting this endpoint from 
> being open to the world. I started down the JAAS route of telling Tomcat to protect it with Kerberos, but I can't figure
> out how to tell Tomcat what JAAS context to use. That is, what outer block do I put in my jaas.config and how do I
> associate it with the block that I add to my web.xml that includes the /idp/profile/oidc/register URL pattern?

Well, that's container-specific actually, but it's part of wiring together all the bits in web.xml. IIRC, the realm-name element typically matches the JAAS application it uses.

>    Even if I can get this working, I'm then going to have to hard code a list of allowed principals inside my web.xml so that
> client registration isn't open to anyone who can authenticate. Is there some way to do this externally?

Well, you can use a role-name of "**" to mean "any", but doing actual authorization I believe means using Tomcat features to do groups. It doesn't have to be inside we.xml but I don't know how flexible it is.

If this is a really a need, and it's not inherently just "wrong" to protect that endpoint, what is needed is an enhancement to turn that flow into an IdP "admin" flow that can leverage the IdP's authentication layer. Then you can do basically anything the IdP can do, plus use the IdP's access control layer.

-- Scott