Shibboleth 4.2.1 and Duo with Nimbus Client issues

[Jeff Chapin]

All,

I am in the process of installing Shibboleth 4.2.1, and I am attempting to
configure Duo (via the Nimbus client), and I am running into issues.

I have installed the module, and I have configured a custom Http Client to
work with out outbound proxy. I *appear* to be communicating with Duo, but
I am getting the following error from Duo in response to the health check:

2023-01-12 13:48:57,330 - 10.1.142.23 - DEBUG
[org.apache.http.wire:87] - http-outgoing-0 << "{"stat": "FAIL",
"code": 40002, "timestamp": 1673552937, "message": "invalid_client",
"message_detail": "Failed to verify signature."}"


This leads me to believe that we are correctly contacting Duo -- but it
does not like what we are sending.

My duo-oidc.properties contains:

idp.duo.oidc.apiHost = api-REDACTED.duosecurity.com
idp.duo.oidc.clientId = DREDACTEDA
idp.duo.oidc.redirectURL =
https://REDACTED.uni.edu/idp/profile/Authn/Duo/2FA/duo-callback
idp.duo.oidc.audit.enabled = true


My secret.properties contains:

idp.duo.oidc.secretKey = 9REDACTEDX



I have confirmed that the clientID and the secretKey match the Client ID
and Client Secret in the Duo control panel, and that the Universal Prompt
is enabled for this pool.


We have MFA set in our idp.properties:

idp.authn.flows= MFA


and we are specifying nextFlow = "authn/DuoOIDC"; in our checkSecondFactor
script, so it should be using this config.

This brings me to my questions:
1) Is there anything obvious I am overlooking?
2) Is there any way to crank up the logging for
net.shibboleth.idp.plugin.authn.duo.nimbus so that I can see what clientID
we are sending to Duo? If we are pulling that value from somewhere else,
seeing what is sent would help locate *where*

Thanks for your time,
Jeff

-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230118/a2d436af/attachment.htm>