<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Not only is this an incomplete solution, we also don’t recommend playing with application-context.xml as it’s not designed to be overridden in local configurations.<div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 25, 2016, at 8:50 AM, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" class="">luiz.omori@duke.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><div class="">I kind of found a workaround: if the configuration below is commented out in application-context.xml then all calls to the dynamic registration endpoint fail as unauthorized. The only thing is that the dynamic registration UI is still displayed and will fail silently.</div><div class=""><br class=""></div><div class=""><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:http pattern="/#{T(org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="stateless"></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" /></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:expression-handler ref="oauthWebExpressionHandler" /></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:intercept-url pattern="/register/**" access="permitAll"/></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"></span></security:http></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Luiz</div><div class=""><div id="MAC_OUTLOOK_SIGNATURE" class=""></div></div></div></div><div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div style="font-family: Calibri; font-size: 12pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class=""><span style="font-weight: bold;" class="">From:<span class="Apple-converted-space"> </span></span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>><br class=""><span style="font-weight: bold;" class="">Date:<span class="Apple-converted-space"> </span></span>Monday, April 25, 2016 at 10:49 AM<br class=""><span style="font-weight: bold;" class="">To:<span class="Apple-converted-space"> </span></span>"Drozdetski, Stan A." <<a href="mailto:drozdetski@mitre.org" style="color: purple; text-decoration: underline;" class="">drozdetski@mitre.org</a>>, Justin Richer <<a href="mailto:jricher@mit.edu" style="color: purple; text-decoration: underline;" class="">jricher@mit.edu</a>>, "<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>><br class=""><span style="font-weight: bold;" class="">Subject:<span class="Apple-converted-space"> </span></span>Re: [mitreid-connect] Disabling Dynamic Client Registration<br class=""></div><div class=""><br class=""></div><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class=""><div class=""><div class="">Thanks. I believe my version (1.2.2) is different than yours. In my case the second option that your are referring to as “allow dynamic registration” is actually “restricted” and it looks like in this case it should be checked.</div><div class=""><br class=""></div><div class="">In any case, playing with scopes this way won’t work well for us.</div><div class=""><br class=""></div><div class=""><picture removed></div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Luiz</div><div class=""><div id="" class=""></div></div></div><div class=""><br class=""></div><span id="OLK_SRC_BODY_SECTION" class=""><div style="font-family: Calibri; font-size: 12pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class=""><span style="font-weight: bold;" class="">From:<span class="Apple-converted-space"> </span></span>"Drozdetski, Stan A." <<a href="mailto:drozdetski@mitre.org" style="color: purple; text-decoration: underline;" class="">drozdetski@mitre.org</a>><br class=""><span style="font-weight: bold;" class="">Date:<span class="Apple-converted-space"> </span></span>Monday, April 25, 2016 at 10:35 AM<br class=""><span style="font-weight: bold;" class="">To:<span class="Apple-converted-space"> </span></span>Justin Richer <<a href="mailto:jricher@mit.edu" style="color: purple; text-decoration: underline;" class="">jricher@mit.edu</a>>, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>>, "<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>><br class=""><span style="font-weight: bold;" class="">Subject:<span class="Apple-converted-space"> </span></span>RE: [mitreid-connect] Disabling Dynamic Client Registration<br class=""></div><div class=""><br class=""></div><div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40" class=""><div bgcolor="white" lang="EN-US" link="blue" vlink="purple" class=""><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class="">FWIW, you can curtail (not disable) dynamic client registration by unchecking BOTH “default scope” and “allow dynamic registration” on the System Scopes screen. That way, dynamically-registered clients will not be given access to useful scopes.<o:p class=""></o:p></span></a></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></span></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 2pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;"><span class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(47, 84, 150);" class="">Stan Drozdetski<o:p class=""></o:p></span></b></span></p><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class=""><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">Extranet Integration Lead<o:p class=""></o:p></span></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class=""><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">Center for Information and Technology<o:p class=""></o:p></span></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class=""><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">781-271-3324<o:p class=""></o:p></span></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class=""><o:p class=""> </o:p></span></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span class=""></span><a href="https://www.facebook.com/MITREcorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image007.png@01D19EDE.3C6586F0"><image007.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://www.linkedin.com/company/mitre" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image008.png@01D19EDE.3C6586F0"><image008.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://twitter.com/MITREcorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image009.png@01D19EDE.3C6586F0"><image009.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://www.youtube.com/user/mitrecorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image010.png@01D19EDE.3C6586F0"><image010.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://plus.google.com/+MitreOrgFFRDCs/posts" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image011.png@01D19EDE.3C6586F0"><image011.png></span></span></span><span class=""></span></a><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class=""><o:p class=""></o:p></span></span></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;"><span class=""></span><a href="http://www.mitre.org/" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;" class=""><span id="cid:image012.jpg@01D19EDE.3C6586F0"><image012.jpg></span></span></span><span class=""></span></a><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""></o:p></span></span></p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></span></div><span class=""></span><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext;" class=""><a href="mailto:mitreid-connect-bounces@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect-bounces@mit.edu</a><span class="Apple-converted-space"> </span>[<a href="mailto:mitreid-connect-bounces@mit.edu" style="color: purple; text-decoration: underline;" class="">mailto:mitreid-connect-bounces@mit.edu</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Justin Richer<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Saturday, April 23, 2016 8:44 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>>;<span class="Apple-converted-space"> </span><a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [mitreid-connect] Disabling Dynamic Client Registration<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">No it has not.<br class=""><br class=""> -- Justin<o:p class=""></o:p></p><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On 4/22/2016 4:38 PM, Luiz Omori wrote:<o:p class=""></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Hi,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We would like to disable dynamic client registration. There is this somewhat old thread about it: <a href="https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/15" style="color: purple; text-decoration: underline;" class="">https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/15</a>. Has the configuration switch mentioned there been created?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Regards,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Luiz<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br class=""><br class=""><o:p class=""></o:p></div><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">_______________________________________________<o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">mitreid-connect mailing list<o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect" style="color: purple; text-decoration: underline;" class="">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a><o:p class=""></o:p></pre></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div></div></span></div></div></span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><span id="cid:image007.png@01D19EDE.3C6586F0"><image007.png></span><span id="cid:image008.png@01D19EDE.3C6586F0"><image008.png></span><span id="cid:image009.png@01D19EDE.3C6586F0"><image009.png></span><span id="cid:image010.png@01D19EDE.3C6586F0"><image010.png></span><span id="cid:image011.png@01D19EDE.3C6586F0"><image011.png></span><span id="cid:image012.jpg@01D19EDE.3C6586F0"><image012.jpg></span></div></blockquote></div><br class=""></div></body></html>