aacli for oidc op

Peter Schober peter.schober at univie.ac.at
Fri Oct 6 08:18:29 UTC 2023


I'd like to test attribute (ok, claims) release with the Shibboleth
IDP when used as OIDC OP.

Seems to me that either aacli does not support that (yet?) or I'm
doing something wrong by feeding it the OIDC RP's `client_id`
as `requester` parameter:

$ ./bin/aacli.sh -n foo -r bar

{
"requester": "bar",
"principal": "foo",
"attributes": [


]
}

The output simply echoes the input, no matter whether the `principal`
or the `requester` exist, attributes are always empty.

Any suggestions for testing the OP part of the machinery (client
registration, attribute resolver, attribute filter, attribute
registry) other than using real clients and watching the audit log (or
process log) closely?

-peter


More information about the users mailing list