Adjust and simplify policy operator combinations #177
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…dual and merged metadata parameter policies (issue openid#129)
vdzhuvinov
requested review from
ve7jtb,
rohe,
peppelinux,
selfissued and
zachmann
peppelinux
approved these changes
Jan 15, 2025
peppelinux
approved these changes
Jan 15, 2025
zachmann
approved these changes
Jan 16, 2025
|
There is an error in the image: The "new" table states the check for The spec text is fine. |
@zachmann Thanks for spotting this, I fixed the table. |
|
Please, ignore this PR for the time being. I had a chat with Roland and we also want to investigate an alternative change where in combinations of the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses issues #11 , #129 , #180.
The chief aim of this PR is to make it easier for architects to devise metadata policies in federations with multiple Trust Anchors or federations with complex topologies. In a single-anchored federation the current, limited operator combinations were okay, because one can simply lookup the policies of the Superior(s) and tweak the local policy where necessary. When dealing with multiple Trust Anchors the limited combinations become a problem. This PR fixes that. It also fixes the
value+essentialcombination, which current spec may lead to policy conflict (#180).This PR incorporates the contributions of @zachmann from PRs #111 and #112 (thanks!), with slight edits , plus several additional combination changes.
The proposed combinations were implemented in the Nimbus OIDC / OAuth SDK and were tested, including tests against a suite of several thousand generated test vectors: https://connect2id.com/blog/metadata-policy-test-vectors-openid-federation
The proposed combinations changes + fix, as a table:
The combinations in draft 41, for comparison. Notice that the updated version has more green or yellow squares for policies to "land", as it covers all logical combinations.
This PR also tightens the language in a few places.