OIDC Grant Types

[Cantor, Scott]

On 6/4/21, 4:02 PM, "users on behalf of Joshua Brodie" <users-bounces at shibboleth.net on behalf of josbrodie at gmail.com> wrote:

>    To support OpenID backchannel transactions, for profiles where it is required, do the IDP nodes have to be
> clustered?

Most of the features work without clustering. I believe there are some that don’t, like token revocation, but the tokens themselves contain all the state and are encrypted with the shared key.

I'd love to understand how people are actually planning to deploy back channel profiles while ensuring that upgrades in the future don't break it. Because I see no practical way to do that short of operating two production systems and forcing people to deploy test RPs against one of them (this is what people nominally think of as running a "test system" but it's really a second production OP in the end).

CAS gets away with it by being very simple and lacking options, so upgrades just don't matter as much. Google gets away with it by not caring what they break. A campus deployment of OIDC would not fit either scenario.

-- Scott