[Openid-specs-ab] Comments on Solberg JWT Federation
nroy at internet2.edu
Thu Aug 2 22:14:50 UTC 2018
On 8/2/18 3:31 PM, Mike Schwartz wrote:
> Actually the OP publishes "scopes_supported" and "claims_supported"
> Roland proposed adding "rp_scopes" and "rp_claims" to metadata
> But neither of these say what claims or scopes are supported by the
> federation, as you do on this page:
Those are just recommendations, they are not enforced in any way, nor
would I want to enforce them. People do stuff with attributes the
federation operator never wants to know about.
SPs can ask for requested attributes via their SAML metadata, and I
would expect RPs to be able to do the same thing, which they can via
> - Mike
> Michael Schwartz
> Founder / CEO
> mike at gluu.org
> On 2018-08-02 15:33, Nick Roy wrote:
>> On 8/2/18 2:10 PM, Mike Schwartz via Openid-specs-ab wrote:
>>> First question, how did you get twitter handle @erlang ?
>>> Here are some comments, just prima facie:
>>> 1. I like the idea to leverage Webfinger. One of my core concerns
>>> he current OIDC federation draft is that it's too static in a day and
>>> age when we're all using lots of API's. And WebFinger is already used
>>> OP's that support dynamic configuration, so why not use it? But one
>>> running in the browser can't host a Webfinger endpoint.
>>> 2. Wouldn't it be better for the client to present it's metadata
>>> dynamic client registration, rather then requiring the OP to call back
>>> to the RP's Webfinger URL at authentication time?
>>> 3. Are you also proposing the use of OP,RP metadata for signing_keys,
>>> signing_keys_uri, and signed_jwks_uri ? Another federation challenge
>>> that key rotation for the jwks_uri happens frequently if you are
>>> following guidelines for best practices (every two days).
>>> 4. What about metadata for the federation itself? Perhaps the
>>> wants to publish certain guidelines, like what are the SAML attributes
>>> it recommends its participants to support? For example, InCommon
>>> recommends use of eduPerson.
>> Wouldn't that be handled by scopes in the metadata statement for the
>>> 5. How would a client register with the federation to get that
>>> persistent identifier? Or is that out of scope of your proposal?
>>> 6. Did you go through the inter-federation use case? Is the data
>>> duplicated? Or does one federation refer back to the other federation?
>>> - Mike
>>> Michael Schwartz
>>> Founder / CEO
>>> mike at gluu.org
>>> Openid-specs-ab mailing list
>>> Openid-specs-ab at lists.openid.net
More information about the Openid-specs-ab