Controlling post-authn flows for OIDC clients

[Wessel, Keith]

Thanks, Scott. Sounds like as good of a reason as any to start moving my OIDC client registrations into the new XML format.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, May 6, 2021 4:32 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Controlling post-authn flows for OIDC clients

On 5/6/21, 5:16 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Is there any other way to add any type of entity attribute to an OIDC client in memory? I know it can't be
> done in the json structure.

Well, I guess you can do virtually anything "in-memory" but there's nothing supported to do that. The metadata is read only on the "query" side. Java can't really enforce that but you'd get race conditions if you started altering anything.

I would imagine that the best hope for hiding use of metadata from those so inclined will be the Unicon front-end if it incorporates those features.

>    If not, is there any other way to control whether the consent flow fires for this client besides the ones I
> mentioned above?

Nothing you didn't identify.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!qWmxJJJK6r3aTSomsd5LyTslxp5Cj8HijXBTPh35GvHFIEuWGm3UGNlQe5ql2DTUnQ$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net