Ex: Re: non-clustered OIDC supporting idp

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Wednesday, November 8, 2023 12:24 PM
> 
> I think it's that additional mention of revocation that's probably the issue, it's
> not just talking about replay. But probably also just time and mood.

Ah, true; I hadn't considered revocation + replay versus just replay. I don't think we will have any use cases where revocation would be needed, I'm assuming OIDC for this box will pretty much just be authenticating users and providing services attributes.

> doesn't work if it's per-server unless you route token requests to servers
> (which BTW we do support).

I noticed that, although we are currently not terminating SSL on the load balancer so at this point we would not be able to avail of layer 7 routing decisions.

> I honestly don't have sufficient expertise in the insane complexity of that
> technology stack to even begin to answer that question

Heh. Yeah. I was roughly familiar with it but now that we are implementing it I've been digging through all the RFC's and protocol documentation and I agree with your assessment :).

Thanks much...