non-clustered OIDC supporting idp

[Cantor, Scott]

> Is this more important security wise for OIDC vs CAS, or is the perceived
> difference in intonation just reflective of the person who happened to write
> it? 

I think it's that additional mention of revocation that's probably the issue, it's not just talking about replay. But probably also just time and mood.

I mean, you really can't deploy revocation usefully without either storing the tokens in a clustered way or storing a revocation list in a clustered way. Replay people can just kind of ignore if they choose to, but revocation simply doesn't work if it's per-server unless you route token requests to servers (which BTW we do support).

> The recommended deployment model for the idp remains stateless, are
> there any specific use cases for OIDC where this would be considered
> unacceptable from a security perspective?

That's a loaded question but I'll skip the obvious joke.

I honestly don't have sufficient expertise in the insane complexity of that technology stack to even begin to answer that question, I'd have to defer to somebody who does. SAML doesn't have anything close to that range of usage models and scenarios so it's much easier to analyze.

-- Scott