OIDC request decryption not optional?

[Henri Mikkonen]

Hi Mathias,

The configuration of an asymmetric encryption credential is currently (in OP 3.3.0) always mandatory. Even if it wasn’t really needed - like in your case.

The security configuration has been refactored heavily for the upcoming OP 3.4.0: there’s no such requirement anymore. The decryption credential is required only if mandated by the configuration for RP. There’ll also be more configuration options for enforcing the use of request objects with varying security configurations.

BR,
Henri.

> On 20. Apr 2023, at 18.00, Bachl, Mathias via users <users at shibboleth.net> wrote:
> 
> Hi,
>  
> I tried to configure an IdP with the OIDC OP plugin without any encryption credential, because we do not support authorization request objects neither by value nor by reference, and therefore no encryption key is used in our setup.
> Unfortunately, authorization requests fail with this configuration, because the availability of an encryption credential is checked in PopulateOIDCEncryptionParameters (“Resolver returned no EncryptionParameters”).
> The parameter “encryptionOptional” is only considered when forDecryption is false (see PopulateOIDCEncryptionParameters#doPreExecute).
> Is there any reason why encryptionOptional cannot be set for decryption? Is there another way to disable checking the presence of an encryption credential?
>  
> Thanks in advance & best regards,
> Mathias
>  
>  
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw <https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230421/58289f93/attachment.htm>