OIDC request decryption not optional?

[Bachl, Mathias]

Hi,

I tried to configure an IdP with the OIDC OP plugin without any encryption credential, because we do not support authorization request objects neither by value nor by reference, and therefore no encryption key is used in our setup.
Unfortunately, authorization requests fail with this configuration, because the availability of an encryption credential is checked in PopulateOIDCEncryptionParameters ("Resolver returned no EncryptionParameters").
The parameter "encryptionOptional" is only considered when forDecryption is false (see PopulateOIDCEncryptionParameters#doPreExecute).
Is there any reason why encryptionOptional cannot be set for decryption? Is there another way to disable checking the presence of an encryption credential?

Thanks in advance & best regards,
Mathias


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230420/1fdc7b31/attachment.htm>