OIDC OP dynamic config

Yeargan, Yancey Yancey.Yeargan at untsystem.edu
Sat Mar 25 16:00:02 UTC 2023 

I have used Shibboleth IdP since around 2007/2008 (shout out to Paul Caskey for helping us get started).

In all those years, I've only done SAML but now trying to add OIDC.

I am following the instructions at
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP

Got to the OPDiscovery topic.
Did the servlet container rewrite to /idp/profile/oidc/configuration
Added the OIDC.Configuration bean to UnverifiedRelyingParty
Modified the default file at $IDP_HOME/static/ openid-configuration.json to set our OIDC issuer and endpoints.

{
   "issuer":"https://sso.unt.edu",
   "authorization_endpoint":"https://sso.unt.edu/idp/profile/oidc/authorize",
   .....
}

When I attempt to retrieve the OP config with a web browser, I get this JSON response.
https://sso.unt.edu/.well-known/openid-configuration

{"error_description":"InputOutputError","error":"server_error"}


This seems simple. What am I missing?

Logs below.

In case anyone reading this message is concerned, I am not working on the production server. I am working on a clone of the production server while overriding DNS in my local /etc/hosts file.

----------

### Identity Provider Information
idp_version: 4.3.0
start_time: 2023-03-25T14:43:05.853Z
current_time: 2023-03-25T14:45:17.908862Z
uptime: PT2M12.055S

enabled modules:
                idp.authn.Duo (Duo Authentication)
                idp.authn.External (External Authentication)
                idp.authn.Function (Function Authentication)
                idp.authn.IPAddress (IPAddress Authentication)
                idp.authn.MFA (MFA Authentication)
                idp.authn.Password (Password Authentication)
                idp.authn.RemoteUser (RemoteUser Authentication)
                idp.authn.RemoteUserInternal (RemoteUserInternal Authentication)
                idp.authn.SPNEGO (SPNEGO Authentication)
                idp.intercept.Consent (Consent Interceptors)
                idp.intercept.ContextCheck (Context Checking Interceptor)
                idp.intercept.ExpiringPassword (Expiring Password Interceptor)
                idp.intercept.Impersonate (Impersonation Interceptor)
                idp.profile.CAS (CAS Protocol Support)
                idp.oidc.OP (OIDC OP)
                idp.oidc.common.2 (Module to provide common OIDC processing)

installed plugins:
                net.shibboleth.idp.plugin.oidc.op Version 3.3.0
                net.shibboleth.oidc.common Version 2.1.0

----------

Logs showing loading of OIDC modules.

2023-03-25 09:43:14,749 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:212] - Module idp.oidc.OP loaded
2023-03-25 09:43:14,750 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties -> conf/oidc.properties (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc-clientinfo-resolvers.xml -> conf/oidc-clientinfo-resolvers.xml (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml -> conf/oidc-credentials.xml (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/attributes/oidc-claim-rules.xml -> conf/attributes/oidc-claim-rules.xml (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/authn/oauth2client-authn-config.xml -> conf/authn/oauth2client-authn-config.xml (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml -> conf/examples/oidc-attribute-filter.xml (replace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-resolver.xml -> conf/examples/oidc-attribute-resolver.xml (replace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/static/openid-configuration.json -> static/openid-configuration.json (noreplace)
2023-03-25 09:43:14,753 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/jwtgen.sh -> bin/jwtgen.sh (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/jwtgen.bat -> bin/jwtgen.bat (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar -> bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh -> bin/issue-access-token.sh (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat -> bin/issue-access-token.bat (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/oidc-clients.sh -> bin/oidc-clients.sh (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/oidc-clients.bat -> bin/oidc-clients.bat (noreplace)
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.AbstractIdPModule:99] - Module idp.oidc.OP checking enabled status
2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.AbstractIdPModule:137] - Module idp.oidc.OP is enabled

2023-03-25 09:43:14,754 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:212] - Module idp.oidc.common.2 loaded
2023-03-25 09:43:14,755 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.AbstractIdPModule:99] - Module idp.oidc.common.2 checking enabled status
2023-03-25 09:43:14,755 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.AbstractIdPModule:102] - Module idp.oidc.common.2 is always enabled
2023-03-25 09:43:14,755 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:143] - Ignoring plugin 'net.shibboleth.idp.plugin.oidc.op' version property in favor of package manifest
2023-03-25 09:43:14,755 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:175] - Plugin net.shibboleth.idp.plugin.oidc.op loaded
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:212] - Module idp.oidc.OP loaded
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties -> conf/oidc.properties (noreplace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc-clientinfo-resolvers.xml -> conf/oidc-clientinfo-resolvers.xml (noreplace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/oidc-credentials.xml -> conf/oidc-credentials.xml (noreplace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/attributes/oidc-claim-rules.xml -> conf/attributes/oidc-claim-rules.xml (noreplace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/authn/oauth2client-authn-config.xml -> conf/authn/oauth2client-authn-config.xml (noreplace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-filter.xml -> conf/examples/oidc-attribute-filter.xml (replace)
2023-03-25 09:43:14,756 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/conf/examples/oidc-attribute-resolver.xml -> conf/examples/oidc-attribute-resolver.xml (replace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/static/openid-configuration.json -> static/openid-configuration.json (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/jwtgen.sh -> bin/jwtgen.sh (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/jwtgen.bat -> bin/jwtgen.bat (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar -> bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.sh -> bin/issue-access-token.sh (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/issue-access-token.bat -> bin/issue-access-token.bat (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/oidc-clients.sh -> bin/oidc-clients.sh (noreplace)
2023-03-25 09:43:14,757 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:214] - Module idp.oidc.OP: Resource /net/shibboleth/idp/plugin/oidc/op/bin/oidc-clients.bat -> bin/oidc-clients.bat (noreplace)
2023-03-25 09:43:14,758 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:143] - Ignoring plugin 'net.shibboleth.oidc.common' version property in favor of package manifest
2023-03-25 09:43:14,758 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:175] - Plugin net.shibboleth.oidc.common loaded
2023-03-25 09:43:14,758 - 172.16.224.1 - DEBUG [net.shibboleth.idp.module.PropertyDrivenIdPModule:212] - Module idp.oidc.common.2 loaded

----------

Logs resulting from attempt to retrieve OIDC configuration from https://sso.unt.edu/.well-known/openid-configuration


2023-03-25 09:44:40,258 - 172.16.224.1 - DEBUG [net.shibboleth.oidc.metadata.impl.AbstractReloadingOIDCEntityResolver:167] - Beginning refresh of metadata from '/opt/shibboleth-idp/static/openid-configuration.json'
2023-03-25 09:44:40,258 - 172.16.224.1 - DEBUG [net.shibboleth.oidc.metadata.impl.AbstractFileOIDCEntityResolver:121] - Returning the contents of /opt/shibboleth-idp/static/openid-configuration.json as byte array
2023-03-25 09:44:40,259 - 172.16.224.1 - DEBUG [net.shibboleth.oidc.metadata.impl.AbstractReloadingOIDCEntityResolver:173] - Processing new metadata from '/opt/shibboleth-idp/static/openid-configuration.json'
2023-03-25 09:44:40,263 - 172.16.224.1 - INFO [net.shibboleth.oidc.metadata.impl.AbstractReloadingOIDCEntityResolver:178] - Parsed entity information for https://sso.unt.edu
2023-03-25 09:44:40,264 - 172.16.224.1 - INFO [net.shibboleth.oidc.metadata.impl.AbstractReloadingOIDCEntityResolver:214] - Next refresh cycle for metadata provider '/opt/shibboleth-idp/static/openid-configuration.json' will occur on '2023-03-25T18:44:40.264090Z' ('2023-03-25T13:44:40.264090-05:00[America/Chicago]' local time)

2023-03-25 09:44:40,267 - 172.16.224.1 - WARN [DEPRECATED:135] - Java class method 'EvaluableScript(parameters...)': This will be removed in the next major version of this software; replacement is by using the setters

2023-03-25 09:44:40,287 - 172.16.224.1 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractInitializeOutboundResponseMessageContext:48] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context
2023-03-25 09:44:40,287 - 172.16.224.1 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:81] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached
2023-03-25 09:44:40,289 - 172.16.224.1 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:253] - Resolving relying party configuration
2023-03-25 09:44:40,290 - 172.16.224.1 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:259] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty

2023-03-25 09:44:40,290 - 172.16.224.1 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:174] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request

2023-03-25 09:44:40,297 - 172.16.224.1 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:147] - Profile Action PopulateProfileInterceptorContext: No inbound interceptor flows active for this request
2023-03-25 09:44:40,298 - 172.16.224.1 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:147] - Profile Action PopulateProfileInterceptorContext: No outbound interceptor flows active for this request

2023-03-25 09:44:40,302 - 172.16.224.1 - WARN [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria

2023-03-25 09:44:40,302 - 172.16.224.1 - ERROR [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:88] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata

2023-03-25 09:44:40,309 - 172.16.224.1 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InputOutputError

2023-03-25 09:44:40,314 - 172.16.224.1 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractBuildErrorResponseFromEvent:159] - Profile Action BuildJSONErrorResponseFromEvent: No mapped event found for InputOutputError, creating general server_error
2023-03-25 09:44:40,314 - 172.16.224.1 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractBuildErrorResponseFromEvent:166] - Profile Action BuildJSONErrorResponseFromEvent: ErrorResponse successfully set as the outbound message

2023-03-25 09:44:40,322 - 172.16.224.1 - WARN [DEPRECATED:128] - Java class method 'setHttpServletResponse', (net.shibboleth.idp.plugin.oidc.op.encoding.impl.NimbusResponseEncoder): This will be removed in the next major version of this software; replacement is setHttpServletResponseSupplier

2023-03-25 09:44:40,336 - 172.16.224.1 - INFO [Shibboleth-Audit.OIDC.Configuration:338] - 172.16.224.1||2023-03-25T14:44:40.336109Z|||||||||||||JSONErrorResponse|||||Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/111.0
2023-03-25 09:44:40,339 - 172.16.224.1 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete

----------


Thanks,
Yancey

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230325/6cec8a8c/attachment.htm>

More information about the users mailing list