aacli for oidc op

[Peter Schober]

Scott Cantor <cantor.2 at osu.edu> [2023-10-06 14:35 CEST]:
> It only supports it in a loose/accidental sense. The tool is part of
> the IdP and the OP is a plugin, so there's no means to extend it to
> support other protocols.

I guessed as much.

> It should populate the requester with whatever the parameter is, but
> it can't honor rules based on e.g. OAuth scope and it won't actually
> support encoding things into JSON in the manner it would for that
> protocol.
> 
> It probably would honor SAML metadata for the requester and apply
> any filter rules that are based on that, but it wouldn't do that for
> any other form of metadata.

OK. (I found it simpler to start with JSON metadata which I now
actually auto-generate from YAML -- which supports comments -- via
Ansible's `to_json` filter.)

So how would we get closer to feature parity with SAML here? Would the
creation of a separate aacli-like OIDC-specific utility be a sensible
stepping stone?

At least I found the aacli to be invaluable when working with SAML
(esp for verification before and after certain configuration changes)
and I expect it would be just as useful with OIDC, though I could be
wrong.
(I'm currently struggling with getting attributes released to a few
OIDC RPs and automatically went to aacli, to no avail.)

-peter