idp-oidc basic setup help

[Francesco Malvezzi]

hi users and experts,

I have been trying to follow the 'install from archive' instruction for
the OIDC plugin [1] for some time, now.

IdP is 4.0.1 and idp-oidc-extension-distribution is 2.0.0. IdP hostname
is idp3.example.org.

In order to check if installation works, I set up a client with
apache2's mod_auth_openidc on appia.example.org.

>From the virtual host:

    		OIDCProviderMetadataURL
https://idp3.example.org/.well-known/openid-configuration
                OIDCClientID my-client-id
                OIDCClientSecret the-secret

                OIDCRedirectURI
https://appia.example.org/idp_oidc/redirect_uri
                OIDCCryptoPassphrase some-stuff
                OIDCScope "openid phone"

  		<Location /idp_oidc>
                        AuthType openid-connect
                        require valid-user
                </Location>

The oidc metadata from the IdP is:
[
  {
    "scope":"openid phone",
    "redirect_uris":["https://appia.example.org/idp_oidc/redirect_uri"],
    "client_id":"my-client-id",
    "client_secret":"the-secret",
    "response_types":["code"],
    "grant_types":["authorization_code"]
  }
]

On visiting https://appia.example.org/idp_oidc the browser is redirected
to IdP. After inserting credentials the flow is broken on the SP with:

[Fri Oct 23 09:27:23.374387 2020] [auth_openidc:error] [pid 21668]
[client 151.67.54.239:59425] oidc_proto_validate_jwt: requested issuer
(https://idp3.example.org) does not match received "iss" value in
id_token (https://idp3.example.org/idp/shibboleth), referer:
https://idp3.example.org/


That is: instead of the issuer I wrongly used the entityID as iss as I
can read on IdP's logs:

2020-10-23 09:45:48,353 - INFO [Shibboleth-Audit.OIDCSSO:282] -
2020-10-23T07:45:48.353165Z|TokenRequest||596aae40-7073-425d-9b5b-2a92ca3a557d|http://csc.fi/ns/profiles/oidc/sso/browser|https://idp3.example.org/idp/shibboleth|OIDCTokenResponse||francesco||at_hash,sub,aud,auth_time,iss,exp,iat,nonce|LTBDZY5EJJRS7XQTX3UCA63BSA62QM2R|

I double checked the file: $IDP_HOME/conf/idp-oidc.properties:

# Set the Open ID Connect Issuer value
idp.oidc.issuer = https://idp3.example.org

What did I overlook?

thank you for your time,

Francesco


[1]
https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive