OIDC client authentication issue

[Scott Cantor]

> Indeed. I just have to remember than with static registration, OIDC client metadata are actually maintained on server side, not on client side...

My advice as it has been for a while is to think about skipping it entirely for internal clients (and most all use of OpenID is with internal clients).

I would set up service accounts to let the OP validate secrets using LDAP or something, and set up default rules and behavior for all the clients to operate them uniformly. About all that's needed is a means of CAS-style validation of endpoints within one's domain, and Henri added a function call out for that in the absence of metadata.

OpenID accomplishes nothing if it's applied the same way SAML is/was. Without removing the overhead, it's a lateral move at best (or by some measures a step back).

I will never have to try all the ideas I had about how to do it, but I still think that's the best way to do it. OpenID and CAS are basically similar. and CAS has the right idea if you're going to strip out that much of the security...I wouldn't have done either given the choice, but if I had to pick one, I'd do OpenID but make it CAS-like.

-- Scott