oidc userinfo endpoint blocking OPTIONS requests

[Christopher Bongaarts]

On 2/3/2021 1:32 AM, Daniel Lutz wrote:
> But I'm not yet quite sure if this is the correct approach. And we 
> need to list patterns
> of RPs, which is not practical.

To be clear, it is the URL of the actual RP service that needs to be 
listed here, not entity IDs.  In our case, putting in a blanket 
*.umn.edu would cover all local apps and all cloud apps where we use a 
local DNS name.  That made sense when we did this to support AJAX, but 
makes less sense to support OIDC PKCE flows.  We're just starting to get 
our feet wet with the latter, so we'll have to see how it goes.  We'll 
probably have to dig into understanding exactly what the security 
ramifications are around which origins are allowed in the CORS filter.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%