Encrypting OIDC secrets in static metadata

[Simon Lundström]

On Tue, 2024-10-01 at 19:13:47 +0200, Cantor, Scott wrote:
> > Ooooh, even Kerberos and LDAP[1] is supported! And you
> > can use a matchExpression="^oidc-.*" to only support
> > certain accounts like "oidc-my-service-user".
> 
> That's the intent. My belief is that for internal use, 99% of OIDC is overkill (sound familiar?) and avoiding client registration entirely should be the goal, not catering to every individual app uniquely. I wanted people to look at using plain old service accounts to authenticate most of their clients, and tie that to a fixed set of rules for claims and so forth.
> 
> If you end up having to register all your clients, I don't think the advantages over SAML are as significant as they should be.

But.. but.. JSON > XML! Federations! The hype!? haha

On a more serious note: The key benefit for me/us is that with OIDC
(welll OAuth2) we get centralized managed (so RPs don't have to invent
the wheel over and over) Machine 2 Machine auth[NZ] which we can use to
finally replace GSSAPI/SPNEGO and custom authZ.

Thanks as always Scott!

BR,
- Simon