OIDC in 4.1.0 and problems with claims

[Darren Boss]

I've been working on our development instance with 4.1.0 and the new
OIDC plugin. I've got things to the point where json based clients
were working and started moving all the clients over to the SAML
metadata format.

Authentication is working but when the user info is requested, this is
what I see in the logs on the IdP:

shib-idp;idp-process.log;dev;nothing;2021-04-06 19:32:30,158 -
206.167.182.21 - INFO
[net.shibboleth.idp.plugin.oidc.op.profile.impl.OIDCMetadataLookupHandler:110]
- Message Handler:  No client information returned for oidctest
shib-idp;idp-process.log;dev;nothing;2021-04-06 19:32:30,336 -
206.167.182.21 - ERROR
[net.shibboleth.idp.consent.flow.storage.impl.ReadConsentFromStorage:66]
- Profile Action ReadConsentFromStorage: Unable to read consent from
storage
shib-idp;idp-process.log;dev;nothing;java.io.IOException:
java.io.IOException:
net.shibboleth.utilities.java.support.logic.ConstraintViolationException:
Storage object was not present in session

Followed by a lot more stacktrace and more errors which I can post in
a follow up but it's likely that "No client information returned for
oidctest" message that is key.

Here is the head of the oidctest metadata file:
<md:EntityDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0"
entityID="oidctest">

In the application which is using mod_openidc and just a php script to
display the environment I see the sub claim as well as nonce, iat,
exp... but nothing from the scopes I've requested.

Scopes were mostly just copy pasted from examples with some
additions/deletions specific to our environment.

While I did have a considerable amount of existing configuration
related to OIDC brought over from 4.0.1, I was pretty careful about
removing all the files that are not in a new installation with the
plugins. I'm running in containers and nothing remains from the old
4.0.1 container build, no old libraries. Just pointing out that this
isn't a brand new install and there might be some old configuration
still causing issues in the OIDC plugin.

SAML SPs are working correctly and getting the right attributes.
-- 
Darren Boss
Senior Programmer/Analyst
Programmeur-analyste principal
darren.boss at computecanada.ca