OIDC Public clients

[Bergmann, Clemens]

Hi,

 

I have a request from a RP that wants to use the public client type [1]. Until now we only had clients that used client secret for authentication.

We use XML Metadata as described in [2] to configure the RPs in the IdP. All our current clients have token_endpoint_auth_method set to “client_secret_post” or “client_secret_basic”.

The documentation regarding the default value [3] and the release notes of 1.1.0 of OIDCRelyingPartyAuthnConfiguration [4] only list “client_secret_basic”, “client_secret_post”, “client_secret_jwt” and “private_key_jwt” as options.

Also [2] states “Only one value per entity” for client_secret.

 

I looked into the code [5] and if I understand it corretly “none” should be an option for token_endpoint_auth_method.

 

Can I configure token_endpoint_auth_method to “none” an don’t set a client_secret to accept a public client?

 

If this is True I would suggest rephrasing the “Only one value per entity” on [2] to “Zero or one value per entity” and describing the available options including “none” somewhere.

 

 

[1] https://datatracker.ietf.org/doc/html/rfc6749#section-2.1

[2] https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile

[3] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879082/OPProfileConfiguration-ClientAuthentication

[4] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3239968769/OIDCRelyingPartyAuthnConfigurationReleaseNotes

[5] https://git.shibboleth.net/view/?p=java-idp-oidc.git;a=blob;f=idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateClientAuthenticationType.java#l165

 

Kind regards

Clemens (Bergmann)

 

-- 

Clemens Bergmann

[er/ihm; he/him]

Gruppe Nutzermanagement und Entwicklung

Technische Universität Darmstadt

Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt

Tel. +49 6151 16 71184

 <http://www.hrz.tu-darmstadt.de/> http://www.hrz.tu-darmstadt.de/

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240514/614cfc59/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7338 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240514/614cfc59/attachment.p7s>