Cannot set idp.oidc.issuer

[Henri Mikkonen]

> On 9. Mar 2021, at 11.21, Martin Haase <Martin.Haase at DAASI.de> wrote:
> 
> Hi list,
> 
> this is now the second time I seem to be unable to set the OIDC issuer for the IdP. This is an upgraded IdPv4, and GEANT OIDC plugin installed along https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive <https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive>
> Although I have set the issuer in idp-oidc.properties...
> 
> idp.oidc.issuer= https://portal-dev.example.prj/idp <https://portal-dev.example.prj/idp>
> ...the OIDC ID token seems to contain the entityID instead:
> 
> [Tue Mar 09 09:08:42.616020 2021] [auth_openidc:error] [pid 18630] [client 10.0.8.7:44184] oidc_proto_validate_jwt: requested issuer (https://portal-dev.example.prj/idp <https://portal-dev.example.prj/idp>) does not match received "iss" value in id_token (https://portal-dev.example.prj/idp <https://portal-dev.example.prj/idp>/shibboleth), referer: https://ubuntu1804sp.daasi.test/dummy-oidc <https://ubuntu1804sp.daasi.test/dummy-oidc>
> Any idea why this could happen, and how to fix it? 


In conf/relying-party.xml, make sure that you have defined 'p:responderIdLookupStrategy-ref=“profileResponderIdLookupFunction”’ for the shibboleth.* beans that contain OIDC profile configurations.

BR,
Henri.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210309/19813e0c/attachment.htm>