Problem with MFA flows for OIDC client

[Darren Boss]

Figured it out, let me know if I did the right thing and if it would be safe to add this to the default profile configuration.

                    <ref bean="OAUTH2.Token" />

Is what I added to the profile configuration with the id=ForceMFA and now the Globus integration is working.
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken

The key phrase is listed at the top of the page:
This profile configuration was introduced in V3.1 of this plugin. In older releases, it was implicitly part of the OIDC.SSO profile configuration and was not a separate feature.
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: December 21, 2023 11:39 AM
To: Shib Users <users at shibboleth.net>
Cc: Darren Boss <Darren.Boss at alliancecan.ca>
Subject: Re: Problem with MFA flows for OIDC client

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

The error is somewhere in the configuration of the OAuth2 client authentication. Same layer is used so the logging and errors are similar, it's basically saying it couldn't run any configured flow for authenticating them.

Out of the box the default configuration just supports the use of client metadata to identify client secrets or keys depending on the method the client used to secure the token request.

The lack of logging and just direct failure suggests an unwarranted change to the defaults around authenticating clients, it's not even trying to do anything.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231221/6654054b/attachment.htm>