On 2019-02-28 11:10 AM, Basney, Jim wrote: > Hi, > > The AARC project has just opened a public consultation on a specification for > IdP hinting: > > https://lists.geant.org/sympa/arc/appint/2019-02/msg00008.html > > It uses an "idphint" parameter that as far as I can tell is equivalent to > CILogon's current "selected_idp" parameter (https://www.cilogon.org/oidc). I > suggest that Custos should follow this AARC-G049 specification and give our > feedback to AARC if we have any concerns. > > For CILogon I think it might be as simple as making "idphint" a synonym for > "selected_idp" (https://jira.ncsa.illinois.edu/browse/CIL-548), though > there's probably some details I'm glossing over. For example I just noticed > that idphint can be a comma separated list, and I think CILogon's > selected_idp can currently just have one value.
Correct. I'm not sure what an SP should do with a comma separated list. Additionally, selected_idp must exactly match an entityID, no 'proxy' allowed in the urlencoded string (as shown in some examples in the spec). Also, for the three OAuth2 providers (Google, GitHub, and ORCID), CILogon uses some specially crafted URIs rather than the "issuer" as shown in the spec. But this could be addressed. > > Reminder that https://cilogon.org/include/idplist.json and > https://cilogon.org/include/idplist.xml can be used to generate the UI for > selecting the IdP and generating the idphint value, though that's a > CILogon-specific interface, so we might work on a more standard approach for > Custos. Note that idplist.xml and idplist.json contain ONLY InCommon entityIDs. For a list that is more dynamic to also include the three OAuth2 providers (Google, GitHub, and ORCID) AND respect a "skin=..." parameter, use https://cilogon.org/idplist/ . -Terry
