Validation failure: Failed to resolve an encryption key

[Mohamed Lrhazi]

In case it helps anyone. my credentials.xml and oidc-credentials.xml were
correct, but were in the wrong folder!!!

Thanks,
Mohamed.

On Thu, Feb 2, 2023 at 2:23 PM Mohamed Lrhazi <lrhazi at cua.edu> wrote:

> Hello,
> am trying to setup OIDC plugin, and testing using this sample app :
> https://github.com/curityio/example-python-openid-connect-client
>
> 2023-02-02 13:43:06,648 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
>> WARN
>> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:258]
>> - Profile Action PopulateOIDCEncryptionParameters: Resolver returned no
>> EncryptionParameters
>> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
>> WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:243] -
>> Validation failure: Failed to resolve an encryption key
>> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
>> DEBUG
>> [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver:226]
>> - No algorithm information in client information, falling back to default
>> configuration
>> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
>> DEBUG
>> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:291]
>> - Profile Action PopulateOIDCEncryptionParameters: Adding OIDC client
>> information to resolution criteria for encryption algorithms
>> 2023-02-02 13:43:06,647 - 172.25.0.1/D5F65DA4F127D957EDB2BBFE68C7F0E6 -
>> DEBUG
>> [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCEncryptionParameters:232]
>> - Profile Action PopulateOIDCEncryptionParameters: Resolving
>> EncryptionParameters for request object decryption
>
>
>
> What could cause this error?
>
> The config for this SP has these settings in it:
>
> <md:SPSSODescriptor protocolSupportEnumeration="
>> http://openid.net/specs/openid-connect-core-1_0.html">
>>         <md:Extensions>
>>             <oidcmd:OAuthRPExtensions
>>                 grant_types="authorization_code implicit refresh_token"
>>                 response_types="id_token code"
>>                 token_endpoint_auth_method="client_secret_post"
>>                 scopes="openid profile offline_access" />
>>         </md:Extensions>
>>         <md:KeyDescriptor>
>>             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>
>> <oidcmd:ClientSecret>the-shared-secret-here</oidcmd:ClientSecret>
>>             </ds:KeyInfo>
>>         </md:KeyDescriptor>
>>
>> <md:NameIDFormat>urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public</md:NameIDFormat>
>>         <md:AssertionConsumerService
>>                 Binding="
>> https://tools.ietf.org/html/rfc6749#section-3.1.2"
>>                 Location="https://localhost:5443/callback"
>>                 index="1"/>
>>     </md:SPSSODescriptor>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230206/99b4b5ba/attachment.htm>