OIDC auth methods client_secret_jwt, private_key_jwt

[Jim Fox]

Thanks,

Adding "token_endpoint_auth_method" and "jwks_uri" to the metadata worked. 
I also had to increase my secret length to 32+ characters.

Note that a shibboleth reload-service.sh for MetadataResolverService does 
not refresh any of those oidc metadata keys.  I had to restart the service 
for that.

Jim

On Thu, 18 Apr 2019, Arto Tuomi wrote:

> Date: Wed, 17 Apr 2019 22:57:33
> From: Arto Tuomi <arto.tuomi at csc.fi>
> To: Shib Dev <dev at shibboleth.net>
> Reply-To: Shib Dev <dev at shibboleth.net>
> Subject: Re: OIDC auth methods client_secret_jwt, private_key_jwt
> 
>
>
>> I like to try using the two jwt auth methods: client_secret_jwt and
>> private_key_jwt.  These need the sp's public key stored somewhere.
>> I can specify a list of supported methods in
>> "token_endpoint_auth_methods_supported", but how do I specify the public key
>> for an SP?
>
> Use  "jwks_uri": "https://host/protected/redirect_uri?jwks=rsa" with the url your RP uses to publish its keys.
>
> If you happen to be using mod_auth_oidc as your RP, create the keys and publish them with:
> OIDCPrivateKeyFiles kid1#/opt/jwk/cert.key
> OIDCPublicKeyFiles kid1#/opt/jwk/cert.crt
>
> Arto
>
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>