OIDC dynamic registration policy ID

[Wessel, Keith]

Okay, I'm intrigued. How would I embed the policy in the token? I know, when I issue a token, that I have to either reference a policy ID or a policy location. Are you referring to referencing a policy location instead of a policy ID?

My plan at this point is to have a default policy for most registrations, presumably web-based clients. Then have a couple of custom policies for apps that are allowed to register callback URIs in certain non-http namespaces. The admins of those custom apps can just use a different policy ID that points to those custom policies when they generate registration tokens.

And, while it's not as straightforward as I'd like, the relying party overrides will work fine for that.

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Wednesday, July 20, 2022 6:17 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: OIDC dynamic registration policy ID

>    I'll submit a feature request when I get a chance to make the 
> defaultMetadataPolicyLocation a simple property on the profile ather 
> than needing to override a bean or build a map of claims and 
> corresponding rules since it would be a whole lot simpler.

I have no doubt there's a ton of room for improvement here, but I'm not best equipped to understand the design that was done, I'm sure there are things I'm not aware of.

Do bear in mind it's not the only way to do it, you can also reference policies when you issue the tokens and just embed them in the tokens.

> I also recognize that this was the first go at implementing metadata policies.

That is the most relevant issue, this is really V1.0 of the plugin when you consider all of the issues, and this work got done very rapidly to meet some member deadlines, so it didn't have a lot of time to get reviewed.

We need deployment feedback, and I can't give it at this point like I do with SAML features, so we're much more dependent on external review.

-- Scott