non-clustered OIDC supporting idp

[Paul B. Henson]

In the documentation at:

	https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879266/OPAuthorization

In the "Replay and Revocation" section, it says:

"It should be noted that the criticality of this cache to CAS and OIDC are generally much higher than for SAML (unless SAML artifacts are used), and the limitations of an in-memory cache that is not clustered across servers much more severe"

This refers to both CAS and OIDC, but the caveats seem to be represented much more harshly than the similar CAS documentation:

	https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631627/CasProtocolConfiguration

Where the primary documentation just says of the stateless ticket service component "This component should be used where possible" other than "deployers that need CAS proxy support still require stateful ticket storage" (which is slightly inaccurate, as shared storage is now only required for a proxy chain, not a single proxy), with a minor caveat in the sample XML configuration:

"A notable limitation of the new component is that the one-time use feature of service and proxy tickets is not available due to the lack of a ticket-tracking mechanism."


Basically, both CAS tickets and OIDC tokens should only be used once, but without shared storage, that cannot be enforced, and they theoretically can be used multiple times within their validity window (although limited to only as many times as there are instances of the idp, as each IDP individually will not allow replay).

Is this more important security wise for OIDC vs CAS, or is the perceived difference in intonation just reflective of the person who happened to write it? The recommended deployment model for the idp remains stateless, are there any specific use cases for OIDC where this would be considered unacceptable from a security perspective?

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768