Unexpected unverified party error for OIDC RP

[Cantor, Scott]

>    If I add OAUTH2.Introspection to UnverifiedRelyingParty, no more
>    errors but I know this isn't correct, I shouldn't have this enabled
>    for UnverifiedRelyingParty.

If it's falling into "unverified", I think that means the client is broken and not authenticating itself to the endpoint. Alternatively, the endpoint is broken and isn't properly configured to handle authentication of the client. I don't think the OIDC certification requires that feature, so I don't know how much it's been used or tested. Henri's on vacation so other than filing a bug that might just turn out to be invalid, I don't have much insight.

The log should obviously provide more detail about the up front processing steps. Might be instructive to compare that trace vs. what a request for a known-working endpoint that requires client auth does before that action step.

-- Scott