AW: OIDC Public clients

[Bergmann, Clemens]

Hi,

can anyone share experience with integrating public clients?
I would also be interested in setting the "aud" claim to allow one client to use the tokens issued for another client.

Kind regards
Clemens (Bergmann)

-- 
Clemens Bergmann
[er/ihm; he/him]
Gruppe Nutzermanagement und Entwicklung
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
Tel. +49 6151 16 71184
http://www.hrz.tu-darmstadt.de/

> -----Ursprüngliche Nachricht-----
> Von: Bergmann, Clemens
> Gesendet: Dienstag, 14. Mai 2024 12:55
> An: 'users at shibboleth.net' <users at shibboleth.net>
> Betreff: OIDC Public clients
> 
> Hi,
> 
> 
> 
> I have a request from a RP that wants to use the public client type [1]. Until
> now we only had clients that used client secret for authentication.
> 
> We use XML Metadata as described in [2] to configure the RPs in the IdP. All
> our current clients have token_endpoint_auth_method set to
> “client_secret_post” or “client_secret_basic”.
> 
> The documentation regarding the default value [3] and the release notes of
> 1.1.0 of OIDCRelyingPartyAuthnConfiguration [4] only list
> “client_secret_basic”, “client_secret_post”, “client_secret_jwt” and
> “private_key_jwt” as options.
> 
> Also [2] states “Only one value per entity” for client_secret.
> 
> 
> 
> I looked into the code [5] and if I understand it corretly “none” should be an
> option for token_endpoint_auth_method.
> 
> 
> 
> Can I configure token_endpoint_auth_method to “none” an don’t set a
> client_secret to accept a public client?
> 
> 
> 
> If this is True I would suggest rephrasing the “Only one value per entity” on [2]
> to “Zero or one value per entity” and describing the available options including
> “none” somewhere.
> 
> 
> 
> 
> 
> [1] https://datatracker.ietf.org/doc/html/rfc6749#section-2.1
> 
> [2]
> https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthR
> PMetadataProfile
> 
> [3]
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/137687908
> 2/OPProfileConfiguration-ClientAuthentication
> 
> [4]
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/323996876
> 9/OIDCRelyingPartyAuthnConfigurationReleaseNotes
> 
> [5] https://git.shibboleth.net/view/?p=java-idp-oidc.git;a=blob;f=idp-oidc-
> extension-
> impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateC
> lientAuthenticationType.java#l165
> 
> 
> 
> Kind regards
> 
> Clemens (Bergmann)
> 
> 
> 
> --
> 
> Clemens Bergmann
> 
> [er/ihm; he/him]
> 
> Gruppe Nutzermanagement und Entwicklung
> 
> Technische Universität Darmstadt
> 
> Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
> 
> Tel. +49 6151 16 71184
> 
> http://www.hrz.tu-darmstadt.de/ <http://www.hrz.tu-darmstadt.de/>
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7338 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240521/b478e100/attachment.p7s>