OIDC Client Secret Resolution with Hashed Secret

[Nathan C Lewan]

hello,

I am working on setting up a credential store of sorts for OIDC Client
Secrets. We are using the ResolverServiceClientSecretValueResolver to
resolve these secrets from an LDAP DataSource, and it is working as
expected.

One question I have is in regards to the comment on the following page
regarding Hashed Secrets:
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879133/OPMetadataClientRegistration#Hashed-Secrets-3.1

Is this saying that I can take the OIDC Client Secret generated by the OIDC
registration process, run it through a SHA-256 Hash, Base64 the results,
and append '{SHA2}' to the resulting string, and stick THAT in my LDAP
attribute, or is it saying something else?

I'm trying to avoid putting the client secret in cleartext in LDAP, and
this appears to be an answer to that, but I wanted to be sure I was
understanding that properly.

thanks for any help!

**
Nathan Lewan
University of Maryland
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230509/36e59fe4/attachment.htm>