authn on RP with ID token ?

[cvuillemez]

I'm wondering:

After successful auth to OP, end-user pass authorization code to RP.
RP retrieves an ID token and Access token from OP.
Finally, RP gives to end-user a session cookie to perform further calls to it, without need to make full OIDC flow again.

In a Apache muti-instance setup, this cookie must be server-side cached and shared by Memcache or Redis.

But in a large environment, we can have hundred or thousand vhosts/websites on multiples hosts, it was not a problem with a "legacy" basic auth, like authnz_ldap module, which doesn't require shared cache.

So migrating legacy authn/authz to OIDC requires to setting up a shared cache for each website ? If yes, It's a tedious process !

My question is:
is it possible to authenticate users to RP with the ID token ? If yes, how auth_openid module can pass ID token to end-user/browser ?
The advantage to use OIDC ID token instead Apache internal session cookie is obvious for me:

• no shared storage needed
• ID token can be verified "on fly" with JWT signature, so does no require HTTP call to OP for each request to RP

But maybe I'm wrong with ID token usage. If someone could clarify... thanks.

[zandbelt]

you can use OIDCSessionType client-cookie, see https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.12.1/auth_openidc.conf#L567

[cvuillemez]

Oh yes I forget to mention I have already tested this setting:
in my case it creates a so huge cookies (~16kB size), for a single website...
Is there a reason ID token can not be used to authenticate user on RP ?

[zandbelt]

an ID token represents an authentication event and cannot be used verbatim for a session; most probably the huge cookies are caused by a large number of claims returned either in the ID token or from the user info endpoint, you could try and minimize that

[cvuillemez]

Yes I have some big claims in user info endpoint, but it's needed claims. Thanks for your response.

[cvuillemez]

I removed a big size claim, to not appear in user info endpoint anymore.
Cookie payload is still a little big: 1722 bytes.
Could you say how the cookie is filling up ?
Does the cookie belong to a single RP or it can be used in a sub-domain ?