Shibboleth 4.2.1 and Duo with Nimbus Client issues

[Cantor, Scott]

> As it turns out, an incorrect value for clientID is *NOT* the only thing that can
> cause this error message to be returned from Duo. If idp.duo.oidc.secretKey is
> unset, it will also return that same error.

It's client ID / key in combination.

> In my case, I had idp.duo.oidc.secretKey in credentials/secrets.properties -- but
> that file was not being loaded for some reason. 

The auto-search only looks in conf/ and the migration of secrets to a separate file is a late addition/convention. Nobody wants to accidentally check in secrets, so putting them all in credentials/ allows everything in conf to be put under control and credentials/ really never should be.

-- Scott