Uploaded image for project: 'Shibboleth User Interface'
  1. Shibboleth User Interface
  2. SHIBUI-2393

Support OIDC Dynamic Registration, add capabilities to interrogate the storage and report on it

    XMLWordPrintable

Details

    • Story
    • Resolution: Done
    • Minor
    • None
    • None
    • None

    Description

      There are two general ways to register and manage OIDC "clients" (RPs), using out of band metadata and dynamically. Metadata is handled through the OIDC type in Metadata Sources ( SHIBUI-2380 ). This ticket addresses Dynamic registration.

      If the SHIBUI has been configured to communicate to the Shibboleth OIDC plugin's API, then the user should be presented a screen where they can enter the following pieces of information:

      • redirect_uris (required)
      • response_types
      • grant_types - One of "authorization_code", "implicit", and "refresh_token"
      • application_type
      • contacts
      • subject_type
      • jwks / jwks_uri
      • token_endpoint_auth_method
      • logo_uri
      • policy_uri
      • tos_uri
      • scope

      The details will be saved to the database (this is not a metadata source subtype and no XML is generated by SHIBUI for this).

      Dynamic Registration will need to be approver following the same process as entity descriptors/metadata sources. 

      Users with ENABLE permissions (including admins) will be able to a[enable | activate | send to Shib] approved registrations

       DB Object should also include:

      • name
      • modifiedDate
      • createdDate
      • createdBy
      • activated

       

      Additional information:

      • Info at:  OPDynamicClientRegistration
      • Scott can't imagine using Dynamic Registration himself (OSU), but feels that if deployers were to do so, they really would need a feature to be able to do this. How many deployers would choose to want to use dynamic registration in the first place?
      • This is a bit different than what the ShibUI does today, more of a "current state of the IdP" admin-type task that would probably want to use the standard API tools. (Go thru the IdP's storage API rather than directly to the "DB".)
      • There are some profile settings (like relying party overrides) that can apply

      Attachments

        1.
        UI: Implement crud views for Managing Dynamic Registrations Sub-task Done Ryan Mathis (unicon.net)
        2.
        BACKEND Sub-task Done Dmitriy Kopylenko (unicon.net)
        3.
        QA Sub-task Done Doug Sonaty
        4.
        SET Sub-task Done Bill Smith (unicon.net)
        5.
        TESTBED: Update the "integration" setup for Shib Sub-task Done Sean Porth
        6.
        Delete dynamic registration confirmation message refers to role Sub-task Done Doug Sonaty
        7.
        Update tooltips on dynamic registration form Sub-task Done Doug Sonaty
        8.
        Missing validation on dynamic registration form Sub-task Done Doug Sonaty
        9.
        Click Save button multiple times creates multiple dynamic registrations Sub-task Done Doug Sonaty
        10.
        All Action Required buttons appearing for ROLE_USER and ROLE_ENABLE Sub-task Done Doug Sonaty
        11.
        Dynamic Registration using Group instead of User for Author field Sub-task Done Doug Sonaty
        12.
        Add Group menu to the Dynamic Registration Configuration screen Sub-task Done Doug Sonaty
        13.
        No Approve Dynamic Registration actions found Sub-task Done Doug Sonaty
        14.
        Delete and Enable Dynamic Registration buttons appearing for non-admin user Sub-task Done Doug Sonaty
        15.
        Cosmetic Issues Sub-task Done Doug Sonaty
        16.
        Increase character limit for Jwks field Sub-task Done Doug Sonaty
        17.
        Actions Required Number not updating Sub-task Done Doug Sonaty
        18.
        Dynamic Registration Name field should be unique Sub-task Done Ryan Mathis (unicon.net)
        19.
        UI: An enabled registration should not be editable/deletable/etc Sub-task Done Doug Sonaty
        20.
        Role change not saving for User Access Request Sub-task Done Doug Sonaty
        21.
        Enable Dynamic Registration link should only appear for Admins Sub-task Done Doug Sonaty
        22.
        Dynamic Registration edits cannot be saved unless Name is changed Sub-task Done Doug Sonaty
        23.
        Users with ROLE_ENABLE cannot enable dynamic registrations Sub-task Done Doug Sonaty
        24.
        Disable call being made for Enable button on Dynamic Registration Configuration page Sub-task Done Doug Sonaty
        25.
        Enabling a Dynamic Registration should also approve it Sub-task Done Charles Hasegawa (unicon.net)
        26.
        Updating Group Approvers does NOT update Dynamic Registration Approval Status Sub-task Done Doug Sonaty

        Activity

          People

            charles.hasegawa@at.internet2.edu Charles Hasegawa (unicon.net)
            steven.erickson@at.internet2.edu Steven Erickson (unicon.net)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: