OIDC clustering

B benthic0 at pm.me
Mon Jul 20 16:01:39 UTC 2026


On Saturday, July 18th, 2026 at 10:28 AM, Scott Cantor via users <users at shibboleth.net> wrote:

> 
> > But that doesn't apply to attributes for claims, where the data stays on the node, correct?
> 
> Attributes generally come from elsewhere, and get resolved at a lot of different points in different requests. In the rare cases that the data only exists during a authorization reques, it can be encoded into the tokens issued for recovery later, so it's trivial (size aside) to resolve data on one server and reissue it from the UserInfo endpoint on another by pulling it from the access token.
> 

So going back to your first reply, and keeping in mind the testing problem, by default does the code returned to the browser by /idp/profile/oidc/authorize on node A contain enough information for node B to run the resolver, so it can respond to a token or userinfo request?

Thanks


More information about the users mailing list