OIDC clustering

[Scott Cantor]

On Jul 20, 2026, at 12:01 PM, B via users <users at shibboleth.net> wrote:
> 
> So going back to your first reply, and keeping in mind the testing problem, by default does the code returned to the browser by /idp/profile/oidc/authorize on node A contain enough information for node B to run the resolver, so it can respond to a token or userinfo request?

Yes, on top of which as I said you can literally relay claims from node A to node B inside the tokens so they don't have to be re-acquired (or if they can't be), at the cost of making the tokens bigger. Otherwise it simply runs the resolver as normal, and the user identity is always there because it's part of the tokens, obviously.

-- Scott