OIDC dynamic client registration validity

[Wessel, Keith]

FYI, setting idp.oidc.dynreg.defaultRegistrationValidity = PT0S does set the expires column for new registrations to null in the database, thanks for that. I also rolled back temporarily in test to the OIDC Common plugin V1.0.0 and the OP plugin version 3.0.1 and used the commented out default for the validity period. The expires column did get set to 24 hours. So, I can't explain why I have a bunch of registrations in my database with a null expiration time.

I did, for testing, register another test client in my database yesterday. It was still there this morning, but just after 24 hours, it's gone. So, something is dropping those from the database. I know you said the JPA storage service doesn't do that, but something is. Doesn't matter to me what it is. I just thought it worth noting that those do get cleaned up.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, March 1, 2022 12:17 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: OIDC dynamic client registration validity

On 3/1/22, 12:56 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    The docs and the commented out value shipped with the IdP state that it's a 24-hour default for registration
> validity. Seems short to me, but who am I to judge.

I think it's geared toward clients that just do it automatically every so often and track it in memory. I don't really think this model makes any sense. I think it makes much more sense to just allow for unregistered clients using client authentication against LDAP or something along those lines.

> I'm going to register something later this afternoon and see if that expires field gets filled in. If it does, then
> this was a (possibly unintentional) change in the last release of the OIDC module.

I don't see any history suggesting it's changed, it always used whatever was in the configuration or a default.

>    If I don't want registrations to expire, what would I set that to? I haven't tried a negative number yet, but I
> haven't had much success with that trick in most cases.

Zero. The Javadoc was wrong, a null won't do that, it just uses the default of a day.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!rp5WLHhF0TjqnqyhI8ygDCTxv3PMEOZzgg-uuhPAp5JqHQZV5F48tt4pKFup3KgUig$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net