OIDC claims missing after upgrade to IdP 4.1

[Cantor, Scott]

On 7/20/21, 6:36 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Thanks, Scott. Yes, I'm expecting to see them in the userinfo response, not the idtoken. I'll try turning off
> consent to see if that helps. I am still seeing that strange uncaught exception that I posted to the list last week
> related to consent. So, that could quite possibly be the issue.

Well, I imagine that's it, but I have no idea what the bug is, other than an uncaught exception is always a bug so there's no point not filing one.

>    If that doesn't help, do you know what class I'd turn up logging for if I wanted to see details on the processing
> for the OIDC attribute filtering?

The new plugins are under net.shibboleth.idp.plugin.oidc.op.attribute.filter, the old ones are the same as always.

As long as a database is involved for consent, make sure none of the options to encode attributes into the tokens are being used to avoid a lot of extra code running. It should be able to look up the consent decisions on the back channel and enforce them there.

All else failing, turn everything but Spring up high and attach it to a bug about the exception. I just doubt there will be much help for a few weeks.

-- Scott