Validation failure: Failed to resolve an encryption key

[Mohamed Lrhazi]

Hello,
am trying to setup OIDC plugin, and testing using this sample app :
https://github.com/curityio/example-python-openid-connect-client

2023-02-02 13:43:06,648 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
> WARN
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:258]
> - Profile Action PopulateOIDCEncryptionParameters: Resolver returned no
> EncryptionParameters
> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
> WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:243] -
> Validation failure: Failed to resolve an encryption key
> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
> DEBUG
> [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver:226]
> - No algorithm information in client information, falling back to default
> configuration
> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
> DEBUG
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:291]
> - Profile Action PopulateOIDCEncryptionParameters: Adding OIDC client
> information to resolution criteria for encryption algorithms
> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
> DEBUG
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:232]
> - Profile Action PopulateOIDCEncryptionParameters: Resolving
> EncryptionParameters for request object decryption



What could cause this error?

The config for this SP has these settings in it:

<md:SPSSODescriptor protocolSupportEnumeration="
> http://openid.net/specs/openid-connect-core-1_0.html">
>         <md:Extensions>
>             <oidcmd:OAuthRPExtensions
>                 grant_types="authorization_code implicit refresh_token"
>                 response_types="id_token code"
>                 token_endpoint_auth_method="client_secret_post"
>                 scopes="openid profile offline_access" />
>         </md:Extensions>
>         <md:KeyDescriptor>
>             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>
> <oidcmd:ClientSecret>the-shared-secret-here</oidcmd:ClientSecret>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>
> <md:NameIDFormat>urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public</md:NameIDFormat>
>         <md:AssertionConsumerService
>                 Binding="https://tools.ietf.org/html/rfc6749#section-3.1.2
> "
>                 Location="https://localhost:5443/callback"
>                 index="1"/>
>     </md:SPSSODescriptor>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230202/e0737798/attachment.htm>