OIDC attribute ("claim") release best practices

[Cantor, Scott]

> The other OIDC specific attribute filter policy is the
> AttributeInOIDCRequestedClaims, which is similar to the OIDCScope policy
> in that it basically says if they ask for it, give it to them. However, I don't
> believe there are any restrictions on what claims any random RP could
> explicitly request?

SAML allows the same. Generally the idea is to combine it, so you could have a rule that says to release something if and only if the RP requests it *and* some other criteria is satisified.

But ultimately, all notions of dynamic/varied release are fantasy, for various reasons. That's just not how the world works, but a lot of people can't let go of the idea and have to learn the lessons we did over and over again.

For myself, I advocate one default ruleset for all clients, because in reality what everyone wants is the same old stuff that's not terribly worth agitating over, name, email, identifier. Everything else is at the extreme edges and a rounding error in terms of interest. Those I would just handle as they come up.

> As I am keeping OIDC RP metadata in xml, if I understand correctly, I can do
> the same thing with OIDC, and just tag them, using my existing policy rules
> based on tags to release attributes?

You should be able to, yes.

> Are there any reasons this would be a poor choice for OIDC?

Eventually I imagine all of us applying SAML metadata to OIDC will be sent to OAuth prison or something.

-- Scott