Can a URI be used as an OIDC client ID?

[Wessel, Keith]

Yes, but the issue is that the IdP is trying to look up an OIDC client with ID of just https. It's dropping the rest of the string.
(RPID https) from the second-to-last log message.

Regardless of whether there's a need to have a colon in the client ID, the spec doesn't state that you can't. So, that sounds like a bug to me.

Thanks, Scott, for confirming that. I'll file a bug.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Ullfig, Roberto Alfredo via users
Sent: Friday, February 17, 2023 9:32 AM
To: Shib Users <users at shibboleth.net>
Cc: Ullfig, Roberto A (UIC) <rullfig at uic.edu>
Subject: Re: Can a URI be used as an OIDC client ID?

With IDP 4.3, we are trying to configure an OIDC client id of https://shibsp-2.uic.edu<https://urldefense.com/v3/__https:/shibsp-2.uic.edu__;!!DZ3fjg!-R5RHUAsJvkHHd2Qn4tkRTWGg4M0V9IQmZZkiZXWmp-8VzYDT8HJx4AtadWO-QYXeBFUsDFN3tTOq7a522kk$>. The error is:

2023-02-17 09:25:39,229 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractDynamicHTTPMetadataResolver:354] - [B2B49187738282D4A714FFBB4516683E] - [128.248.156.240] - Metadata Resolver FunctionDrivenDynamicHTTPMetadataResolver incommon: Non-ok status code '404' returned from remote metadata source: https://mdq.incommon.org/entities/https<https://urldefense.com/v3/__https:/mdq.incommon.org/entities/https__;!!DZ3fjg!-R5RHUAsJvkHHd2Qn4tkRTWGg4M0V9IQmZZkiZXWmp-8VzYDT8HJx4AtadWO-QYXeBFUsDFN3tTOq6uMjZS6$>
2023-02-17 09:25:39,232 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170] - [B2B49187738282D4A714FFBB4516683E] - [128.248.156.240] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/oauth2/token<https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/oauth2/token__;!!DZ3fjg!-R5RHUAsJvkHHd2Qn4tkRTWGg4M0V9IQmZZkiZXWmp-8VzYDT8HJx4AtadWO-QYXeBFUsDFN3tTOq2C-EmYq$> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https)
2023-02-17 09:25:39,238 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - [B2B49187738282D4A714FFBB4516683E] - [128.248.156.240] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration

This is the first time that we are trying out the OIDC plugin. We haven't addressed all the deprecated warnings yet so maybe it's related to that. If we remove the ":" character it works just fine. Using a FQDN seems like a good solution at present.

---
Roberto Ullfig - rullfig at uic.edu<mailto:rullfig at uic.edu>
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Cantor, Scott via users <users at shibboleth.net<mailto:users at shibboleth.net>>
Sent: Friday, February 17, 2023 8:51 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Cc: Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
Subject: Re: Can a URI be used as an OIDC client ID?

It's a major bug if it doesn't work, I would never use anything but a URI as a client_id, the idea is just ridiculous.

I can't imagine we wouldn't have tested it, but I suppose it's possible it doesn't work with the original JSON resolvers. Still a bug. Even OIDC doesn't *preclude* doing it.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Crullfig%40uic.edu%7C183ab72050274a26845a08db10f68082%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C638122423124388779%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=GLF9clUCxeDbdjirAT28pyU3isnjV%2FO9eiFLsAp2yaw%3D&reserved=0<https://urldefense.com/v3/__https:/nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fx*2FZYEpPw&data=05*7C01*7Crullfig*40uic.edu*7C183ab72050274a26845a08db10f68082*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C638122423124388779*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=GLF9clUCxeDbdjirAT28pyU3isnjV*2FO9eiFLsAp2yaw*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!DZ3fjg!-R5RHUAsJvkHHd2Qn4tkRTWGg4M0V9IQmZZkiZXWmp-8VzYDT8HJx4AtadWO-QYXeBFUsDFN3tTOqy0EQ1Ly$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230217/50f9af22/attachment.htm>