OIDC metadata policy template question

[Cantor, Scott]

On 5/27/22, 11:25 AM, "users on behalf of Wessel, Keith via users" <users-bounces at shibboleth.net on behalf of users at shibboleth.net> wrote:

> I assume it's allowed since the template doesn't include definitions for basic things like client_id. But I wanted
> to be sure.

Pretty sure it's allowed, but that only applies to "known" claims I think. The system ignores/drops anything it doesn't understand *unless* a policy is added. I know that because I had to get a test working with the audience claim we added to control JWT handling and I had to create a policy for that.

Which is to say, we probably need to document exactly which ones are known/understood to really nail that down.

This came up with the request_uri feature also, which we block by default now if somebody tries to register that but you can authorize it with the policy feature.

-- Scott