Encrypting OIDC secrets in static metadata

[Cantor, Scott]

> Ooooh, even Kerberos and LDAP[1] is supported! And you
> can use a matchExpression="^oidc-.*" to only support
> certain accounts like "oidc-my-service-user".

That's the intent. My belief is that for internal use, 99% of OIDC is overkill (sound familiar?) and avoiding client registration entirely should be the goal, not catering to every individual app uniquely. I wanted people to look at using plain old service accounts to authenticate most of their clients, and tie that to a fixed set of rules for claims and so forth.

If you end up having to register all your clients, I don't think the advantages over SAML are as significant as they should be.

> A StaticDataConnector via Attribute Resolver Resolution
> should also be reloadable, right? And a 
> ScriptedDataConnector with ScriptFile (easier
> to generate a stand alone file) too?

Anything done with the resolver is reloadable, it inits itself from scratch each time.

> What else is reloadable and easily generated outside of the
> IDP?

Most often the resolver is the place to look for embedding functionality like that because most things can be turned into an attribute expression in some way.

Notably, the resolver can also have side effects. The HTTP Connector is extremely good at calling REST APIs, with the exception that it doesn't yet have native support for OAuth authentication, something that needs to get added somehow.

-- Scott