<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>In our case we just want to disable the endpoint. We are not really concerned about it being listed in the discovery document and don’t care much if the UI fails. Our users (internal only) would be instructed to not use that feature. </div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Date: </span>Monday, April 25, 2016 at 12:09 PM<br>
<span style="font-weight:bold">To: </span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu">luiz.omori@duke.edu</a>><br>
<span style="font-weight:bold">Cc: </span>"Stan A. Drozdetski" <<a href="mailto:drozdetski@mitre.org">drozdetski@mitre.org</a>>, "<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [mitreid-connect] Disabling Dynamic Client Registration<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
There are a handful of other small hooks, like publication of the registration endpoint in the discovery document. You’d want all of those, including the UI, to be tied together with the same configuration.
<div class=""><br class="">
</div>
<div class=""> — Justin</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Apr 25, 2016, at 9:04 AM, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" class="">luiz.omori@duke.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">
<div class="">
<div class="">Assuming you are not talking about the UI piece, can you elaborate on the “incomplete” part?</div>
<div class="">
<div id="" class=""></div>
</div>
</div>
</div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
<div class="">Luiz</div>
<div class=""><br class="">
</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="font-family: Calibri; font-size: 12pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class="">
<span style="font-weight:bold" class="">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu" class="">jricher@mit.edu</a>><br class="">
<span style="font-weight:bold" class="">Date: </span>Monday, April 25, 2016 at 11:57 AM<br class="">
<span style="font-weight:bold" class="">To: </span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu" class="">luiz.omori@duke.edu</a>><br class="">
<span style="font-weight:bold" class="">Cc: </span>"Stan A. Drozdetski" <<a href="mailto:drozdetski@mitre.org" class="">drozdetski@mitre.org</a>>, "<a href="mailto:mitreid-connect@mit.edu" class="">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu" class="">mitreid-connect@mit.edu</a>><br class="">
<span style="font-weight:bold" class="">Subject: </span>Re: [mitreid-connect] Disabling Dynamic Client Registration<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Not only is this an incomplete solution, we also don’t recommend playing with application-context.xml as it’s not designed to be overridden in local configurations.
<div class=""><br class="">
</div>
<div class=""> — Justin</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Apr 25, 2016, at 8:50 AM, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" class="">luiz.omori@duke.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<div class="">
<div class="">I kind of found a workaround: if the configuration below is commented out in application-context.xml then all calls to the dynamic registration endpoint fail as unauthorized. The only thing is that the dynamic registration UI is still displayed
and will fail silently.</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:http pattern="/#{T(org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint).URL}/**" use-expressions="true" entry-point-ref="oauthAuthenticationEntryPoint" create-session="stateless"></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:custom-filter ref="corsFilter" after="SECURITY_CONTEXT_FILTER" /></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:expression-handler ref="oauthWebExpressionHandler" /></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span><security:intercept-url pattern="/register/**" access="permitAll"/></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span></security:http></div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
<div class="">Luiz</div>
<div class="">
<div id="" class=""></div>
</div>
</div>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br class="">
</div>
<span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<div style="font-family: Calibri; font-size: 12pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class="">
<span style="font-weight: bold;" class="">From:<span class="Apple-converted-space"> </span></span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>><br class="">
<span style="font-weight: bold;" class="">Date:<span class="Apple-converted-space"> </span></span>Monday, April 25, 2016 at 10:49 AM<br class="">
<span style="font-weight: bold;" class="">To:<span class="Apple-converted-space"> </span></span>"Drozdetski, Stan A." <<a href="mailto:drozdetski@mitre.org" style="color: purple; text-decoration: underline;" class="">drozdetski@mitre.org</a>>, Justin Richer
<<a href="mailto:jricher@mit.edu" style="color: purple; text-decoration: underline;" class="">jricher@mit.edu</a>>, "<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>><br class="">
<span style="font-weight: bold;" class="">Subject:<span class="Apple-converted-space"> </span></span>Re: [mitreid-connect] Disabling Dynamic Client Registration<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">
<div class="">Thanks. I believe my version (1.2.2) is different than yours. In my case the second option that your are referring to as “allow dynamic registration” is actually “restricted” and it looks like in this case it should be checked.</div>
<div class=""><br class="">
</div>
<div class="">In any case, playing with scopes this way won’t work well for us.</div>
<div class=""><br class="">
</div>
<div class=""><picture removed></div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
<div class="">Luiz</div>
<div class="">
<div id="" class=""></div>
</div>
</div>
<div class=""><br class="">
</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="font-family: Calibri; font-size: 12pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);" class="">
<span style="font-weight: bold;" class="">From:<span class="Apple-converted-space"> </span></span>"Drozdetski, Stan A." <<a href="mailto:drozdetski@mitre.org" style="color: purple; text-decoration: underline;" class="">drozdetski@mitre.org</a>><br class="">
<span style="font-weight: bold;" class="">Date:<span class="Apple-converted-space"> </span></span>Monday, April 25, 2016 at 10:35 AM<br class="">
<span style="font-weight: bold;" class="">To:<span class="Apple-converted-space"> </span></span>Justin Richer <<a href="mailto:jricher@mit.edu" style="color: purple; text-decoration: underline;" class="">jricher@mit.edu</a>>, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>>,
"<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a>><br class="">
<span style="font-weight: bold;" class="">Subject:<span class="Apple-converted-space"> </span></span>RE: [mitreid-connect] Disabling Dynamic Client Registration<br class="">
</div>
<div class=""><br class="">
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40" class="">
<div bgcolor="white" lang="EN-US" link="blue" vlink="purple" class="">
<div class="WordSection1" style="page: WordSection1;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<a name="_MailEndCompose" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class="">FWIW, you can curtail (not disable) dynamic client registration by unchecking BOTH “default scope” and “allow dynamic registration”
on the System Scopes screen. That way, dynamically-registered clients will not be given access to useful scopes.<o:p class=""></o:p></span></a></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></span></div>
<div class="">
<p class="MsoNormal" style="margin: 0in 0in 2pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;">
<span class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(47, 84, 150);" class="">Stan Drozdetski<o:p class=""></o:p></span></b></span></p>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class="">
<span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">Extranet Integration Lead<o:p class=""></o:p></span></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class="">
<span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">Center for Information and Technology<o:p class=""></o:p></span></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 13pt;" class="">
<span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class="">781-271-3324<o:p class=""></o:p></span></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class=""><o:p class=""> </o:p></span></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span class=""></span><a href="https://www.facebook.com/MITREcorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image007.png@01D19EDE.3C6586F0" class=""><image007.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://www.linkedin.com/company/mitre" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image008.png@01D19EDE.3C6586F0" class=""><image008.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://twitter.com/MITREcorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image009.png@01D19EDE.3C6586F0" class=""><image009.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://www.youtube.com/user/mitrecorp" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image010.png@01D19EDE.3C6586F0" class=""><image010.png></span></span></span><span class=""></span></a><span class=""></span><a href="https://plus.google.com/+MitreOrgFFRDCs/posts" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; text-decoration: none;" class=""><span id="cid:image011.png@01D19EDE.3C6586F0" class=""><image011.png></span></span></span><span class=""></span></a><span class=""><span style="font-size: 9pt; font-family: Calibri, sans-serif; color: rgb(127, 127, 127);" class=""><o:p class=""></o:p></span></span></div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;">
<span class=""></span><a href="http://www.mitre.org/" style="color: purple; text-decoration: underline;" class=""><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); text-decoration: none;" class=""><span id="cid:image012.jpg@01D19EDE.3C6586F0" class=""><image012.jpg></span></span></span><span class=""></span></a><span class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""></o:p></span></span></p>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></span></div>
<span class=""></span>
<div class="">
<div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext;" class=""><a href="mailto:mitreid-connect-bounces@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect-bounces@mit.edu</a><span class="Apple-converted-space"> </span>[<a href="mailto:mitreid-connect-bounces@mit.edu" style="color: purple; text-decoration: underline;" class="">mailto:mitreid-connect-bounces@mit.edu</a>]<span class="Apple-converted-space"> </span><b class="">On
Behalf Of<span class="Apple-converted-space"> </span></b>Justin Richer<br class="">
<b class="">Sent:</b><span class="Apple-converted-space"> </span>Saturday, April 23, 2016 8:44 AM<br class="">
<b class="">To:</b><span class="Apple-converted-space"> </span>Luiz Omori <<a href="mailto:luiz.omori@duke.edu" style="color: purple; text-decoration: underline;" class="">luiz.omori@duke.edu</a>>;<span class="Apple-converted-space"> </span><a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a><br class="">
<b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [mitreid-connect] Disabling Dynamic Client Registration<o:p class=""></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;">
No it has not.<br class="">
<br class="">
-- Justin<o:p class=""></o:p></p>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
On 4/22/2016 4:38 PM, Luiz Omori wrote:<o:p class=""></o:p></div>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="">
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Hi,<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
We would like to disable dynamic client registration. There is this somewhat old thread about it: <a href="https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/15" style="color: purple; text-decoration: underline;" class="">https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/15</a>. Has
the configuration switch mentioned there been created?<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Regards,<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Luiz<o:p class=""></o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<br class="">
<br class="">
<br class="">
<o:p class=""></o:p></div>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">_______________________________________________<o:p class=""></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">mitreid-connect mailing list<o:p class=""></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><a href="mailto:mitreid-connect@mit.edu" style="color: purple; text-decoration: underline;" class="">mitreid-connect@mit.edu</a><o:p class=""></o:p></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect" style="color: purple; text-decoration: underline;" class="">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a><o:p class=""></o:p></pre>
</blockquote>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
</div>
</div>
</span></div>
</div>
</span><span style="font-family: Calibri, sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""></span><span id="cid:image007.png@01D19EDE.3C6586F0" class=""><image007.png></span><span id="cid:image008.png@01D19EDE.3C6586F0" class=""><image008.png></span><span id="cid:image009.png@01D19EDE.3C6586F0" class=""><image009.png></span><span id="cid:image010.png@01D19EDE.3C6586F0" class=""><image010.png></span><span id="cid:image011.png@01D19EDE.3C6586F0" class=""><image011.png></span><span id="cid:image012.jpg@01D19EDE.3C6586F0" class=""><image012.jpg></span></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</span></div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</span>
</body>
</html>