OIDC and dynamic ports on the metadata redirect_uris?

[Scott Cantor]

We don't support anything like that, and even for unregistered clients we don't have a real solution implemented to handle some other kind of validation approach for the URL. Dynamic registration works of course, but requires a database, and would imply something registering from scratch every time, as the dynamic registration spec doesn't include updating.

I intended to work on a pluggable validation approach using an extension point in the metadata policy layer where you can register a custom "matching operator" as a Spring bean but it never got that far before it became clear I wouldn't be at OSU long enough to do anything with it.

I think the extension point is there and makes it theoretically possible to implement something, but I don't know for certain.

I still believe unregistered clients are the right "inside the firewall" approach for generic SSO use cases, but since I will never have to deploy OpenID in anger, it's sort of an academic point now unless somebody else decides to run with it for real and bottom out the concept.

If there's an actual RFC that supports needing to do something in particular we're not doing, then filing an issue is the way to get it resolved.

-- Scott