Protecting my OIDC dynamic client registration endpoint in Tomcat

[Cantor, Scott]

On 9/22/20, 5:37 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Given all that, I'll consider just limiting it to campus IP space. But if I do attempt the JAAS thing, you say the realm
> name typically maches the JAAS application it uses. It aht something standard if it's coming from the IdP?

This is a container thing, it has nothing to do with the IdP.

> Or is it more custom than that? I've seen the various web.xml pieces that need to be wired together and think I get that
> part.

That's all there is (along with whatever else is involved in the container to "trigger" JAAS for the container or the webapp context.

I haven't done any of that for a while, and I don't remember at all whether I ever figured out to do it with Jetty. I thnk that was one case Tomcat was much easier to deal with.

>    I'd love for someone to inform me that it's wrong to protect this flow.

I don't know what OIDC "intends" it be used to do. If it's like SCIM and it's just "security is out of scope", then indeed it really needs to be built differently to support more of the IdP's machinery to really be usable. That includes invoking our AccessControl layer also, obviously.

-- Scott