Redirect_uri in dynamically registered OIDC client can't be localhost

[Wessel, Keith]

Henri,

Am I sure? No. I thought we had pulled this off with dynamic registrations, but I could be totally off on that. So, thanks for pointing out the details in the spec which I should have checked before emailing the list.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
Sent: Friday, February 18, 2022 12:44 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Redirect_uri in dynamically registered OIDC client can't be localhost


> On 18. Feb 2022, at 5.45, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> We discovered this a while back, but we've ignored it, and I'm wondering if it was an intentional choice or just a side effect of URL sanity checking. At least since V3.0, and maybe before, the IdP refuses to accept a dynamically registered OIDC client that has localhost as a hostname. I don't think it's localhost that it specifically disapproves of; I think it's the lack of a dot. Localhost.localdomain, for instance, works if it's in the hostname part of the URL.

We’ve followed the rules for the metadata values as specified by the OIDC dynamic client registration spec [1]. See the section 2 (Client metadata) and ‘application_type’.

If the application_type is undefined or ‘web’  (default), localhost as the hostname is not accepted. The hostnames may contain localhost as substring though.

[1] https://urldefense.com/v3/__https://openid.net/specs/openid-connect-registration-1_0.html__;!!DZ3fjg!pI4klBHxmSaooqejCgTRgKrvRphZMYqsU7Bi7ZuR2YJ73PHnzDLphTLcBs-rSvTB9A$ 

> This used to work in earlier versions of the OIDC extension. It definitely worked back in the days of 1.X.

Umm, the code regarding this feature hasn’t changed in ages. Are you sure that the registartion request message has been similar for 1.X, or did it for instance contain application_type=native?

> Is this intentional? And, if so, is there some undocumented property or parameter to allow it?

There’s no properties for managing this at the moment.

BR,
Henri.
-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!pI4klBHxmSaooqejCgTRgKrvRphZMYqsU7Bi7ZuR2YJ73PHnzDLphTLcBs_4nIzn-w$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net