Unexpected unverified party error for OIDC RP

[Darren Boss]

My guess was it wasn't authenticating itself to the endpoint but
didn't want to jump to conclusions. I'm poking at the endpoints now
but my curl fu needs some work.

The developers are responsive too and asking how they can assist which
is good. They are also testing with Keycloak and both mentioned that
when working with Keycloak, they didn't have to specify
client_secret_post nor are they having failures with the introspection
endpoint. I suspect the Keycloak introspection endpoint is wide open
and not requiring authentication but at this point it's just a guess.
Doing a bunch of testing now to try and discover more about all the
different IdP environments (4.0.1, 4.2.1 and Keycloak).

On Thu, Jul 15, 2021 at 10:50 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> >    If I add OAUTH2.Introspection to UnverifiedRelyingParty, no more
> >    errors but I know this isn't correct, I shouldn't have this enabled
> >    for UnverifiedRelyingParty.
>
> If it's falling into "unverified", I think that means the client is broken and not authenticating itself to the endpoint. Alternatively, the endpoint is broken and isn't properly configured to handle authentication of the client. I don't think the OIDC certification requires that feature, so I don't know how much it's been used or tested. Henri's on vacation so other than filing a bug that might just turn out to be invalid, I don't have much insight.
>
> The log should obviously provide more detail about the up front processing steps. Might be instructive to compare that trace vs. what a request for a known-working endpoint that requires client auth does before that action step.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Darren Boss
Senior Programmer/Analyst
Programmeur-analyste principal
darren.boss at computecanada.ca