Notes from Ivan: For idpy-oidc, work is being done around the support for native clients, especially supporting variable ports for redirect URIs. Along with that work, more checks are added around the validity of a redirect URI. The redirect URI should be a URL as it will become part of the Location HTTP header. The standard python libraries (urllib.parse) do not perform any kind of validation and will even accept ports with letters. Additionally, we need to properly check for the URI scheme. I'd like us to have a denylist (or an allowlist) for schemes. Schemes like "data://" and "javascript://" should be denied. On another front, I have been working to generate test data with the Faker library. It integrates with pytest too. We can use that library to generate randomized data that follow some specific format. Given a seed, we can recreate the same data. A few useful references here: - https://faker.readthedocs.io/ -https://faker.readthedocs.io/en/stable/providers.html -https://faker.readthedocs.io/en/stable/communityproviders.html Matthew brought up the topic of tidying up the satosa repo. This relates to https://github.com/IdentityPython/SATOSA/pull/454. We agreed to separate the configuration changes from changes after applying the settings (big changes on the source code etc). We should agree when to apply the changes; certainly after the new release that is to come.