After reviewing the provided documentation and understanding the involved technologies and standards, I’d like to request the setup of our IDAC in the Rubin authentication system.
Currently, we have several services in our environment integrated via Satosa proxy, which interacts with the authentication services of the Brazilian Federated Academic Community (CAFe) and CILogon. In this context, I’d like to register our Satosa instances (homolog and production) as an OpenID Connect Client in the Rubin authentication system.
One point that I’d like to clarify is the OIDC discovery configuration. The Satosa OpenID Connect Client implementation supports configuration discovery via the /.well-known/openid-configuration endpoint. Do you have a corresponding URL?
I have staged this client configuration for data.lsst.cloud and will deploy it this Thursday during our normal patch window from 15:00 to 17:00 Pacific Daylight Time. I sent Carlos the client_id and client_password information for both clients via Slack and a one-time link.
This is the first client for the data.lsst.cloud Science Platform, so currently none of the OpenID Connect server URLs will work. They will be enabled on Thursday.
Once that is done, use https://data.lsst.cloud/.well-known/openid-configuration for configuration discovery. Hopefully that will work. Let us know if you run into problems; at present, this is a very limited OpenID Connect implementation and only supports a narrow subset of the full standard.