Protecting my OIDC dynamic client registration endpoint in Tomcat

[Greg Haverkamp]

On Tue, Sep 22, 2020 at 2:37 PM Wessel, Keith <kwessel at illinois.edu> wrote:

>
> I'd love for someone to inform me that it's wrong to protect this flow. If
> not, I'll propose a feature in Jira for an IdP admin flow. You're very
> right: that would be much cleaner than what I'm doing here.
>

It's not wrong to protect the client registration endpoint.  However, the
spec does say it should be via an "initial access token":

3.  Client Registration Endpoint
> The Client Registration Endpoint is an OAuth 2.0 Protected Resource
> through which a new Client registration can be requested. *The OpenID
> Provider MAY require an Initial Access Token that is provisioned
> out-of-band (in a manner that is out of scope for this specification) to
> restrict registration requests to only authorized Clients or developers.*
> To support open Dynamic Registration, the Client Registration Endpoint
> SHOULD accept registration requests without OAuth 2.0 Access Tokens. These
> requests MAY be rate-limited or otherwise limited to prevent a
> denial-of-service attack on the Client Registration Endpoint. If an Initial
> Access Token is required for Client registration, the Client Registration
> Endpoint MUST be able to accept these Access Tokens in the manner described
> in the OAuth 2.0 Bearer Token Usage [RFC6750] specification.


(
https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration
)

As an example, our OP/AS implementation (Connect2id) offers a couple of
mechanisms for obtaining initial access tokens.  There are some static ones
for admin-level requests, and then they can also be generated through the
use of other clients, which is nice, because you can also put some limits
on the metadata components that can be registered.  ("Nice" to have, I
guess, though we actually haven't handed any out.  We've registered all of
our clients to date.)

That said, I don't think the OIDF has formed a police force that's going to
come knocking if you protect the endpoint some other way.  I think the
biggest problem will come from users of RP code that won't know how to
navigate something other than the access token-based access.

Greg

>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200923/0c81c44e/attachment.htm>