Encrypting OIDC secrets in static metadata

[Wessel, Keith]

Thanks, all, for all the discussion on this.

One question regarding secrets by reference. The documentation shows how to do this using XML-format OIDC metadata. Is there a way to include a reference in static JSON-format metadata? I can certainly convert all of my static metadata to XML if need be but would rather not.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Henri Mikkonen
Sent: Tuesday, October 1, 2024 2:54 AM
To: users at shibboleth.net
Subject: Re: Encrypting OIDC secrets in static metadata

Hi Keith,

On 1.10.2024 1.04, Wessel, Keith via users wrote:
> Is it possible, or are there plans to make it possible, to encrypt those 
> stored secrets with some key known only to the IdP? Seems trivial enough 
> with a two-way encryption algorithm used from my novice perspective.

Check the "client secret resolution by reference" section, especially 
the "attribute resolution resolution":

https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879133/OPMetadataClientRegistration*Attribute-Resolver-Resolution__;Iw!!DZ3fjg!8KCwRS14yzZOO38WK6lZ_6xF8gGt8L8ZIDzh-0dRyrf_GInDOSrZnuWugFhCvLzCAM_qFdacXQCpHibX4S7cHLhKojIhWg$ 

In short, this method will provide you means to resolve the plaintext 
client secret value via IdP's attribute resolver engine. The reference 
key is set via ClientSecretKeyReference SAML metadata element. As all 
the features of IdP's attribute resolver are available, you should find 
good building blocks for various use cases: including local encryption 
of the values or for instance fetching the values via API from a remote 
server.

BR,
Henri.
-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!8KCwRS14yzZOO38WK6lZ_6xF8gGt8L8ZIDzh-0dRyrf_GInDOSrZnuWugFhCvLzCAM_qFdacXQCpHibX4S7cHLjS1hW5VQ$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net