OIDC Grant Types

[Ray Bon]

Joshua,

Each host that connects to the load balancer will get its own sticky session. The back channel request will be independent of the front channel and thus may be to a different server.
When session data needs to be persisted, it needs to be shared/clustered.

Ray

On Fri, 2021-06-04 at 13:01 -0700, Joshua Brodie wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Thank you Henri.

It took me a while to research OpenID Connect to understand all the options (still learning).

To support OpenID backchannel transactions, for profiles where it is required, do the IDP nodes have to be clustered? We run 4 IDP nodes behind a sticky session load balancer (the IDP servers are standalone -- in the backend on the same DB, AD etc).



On Mon, 31 May 2021 at 22:17, Henri Mikkonen <henri.mikkonen at csc.fi<mailto:henri.mikkonen at csc.fi>> wrote:
Hi Joshua,

> On 31. May 2021, at 0.17, Joshua Brodie <josbrodie at gmail.com<mailto:josbrodie at gmail.com>> wrote:
>
> Does the OIDC plugin for IdP4.1 support both ‘Implicit’ and ‘Authentication/Basic’ flows?
>
> On my super preliminary dipping toe in water, appears to be ‘Implicit’ only - which happens to be what we require.

The OIDC OP plugin supports all the OIDC conformance profiles defined in section 2.1 of [1].

BR,
Henri.

[1] https://openid.net/wordpress-content/uploads/2018/06/OpenID-Connect-Conformance-Profiles.pdf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210604/ff63a3a1/attachment.htm>