OIDC InvalidRedirectionURI

[Paul B. Henson]

So I set up some test oidc metadata in XML format:

  <EntityDescriptor entityID="https://openidconnect.net/">
    <SPSSODescriptor protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
      <Extensions>
        <oidcmd:oidcOAuthRPExtensions grant_types="authorization_code"
                                      response_types="code"
                                      scopes="openid" />
    </Extensions>
    <NameIDFormat>urn:mace:shibboleth:metadata:oidc:1.0:nameid-format:public</NameIDFormat>
    <AssertionConsumerService Binding="https://tools.ietf.org/html/rfc6749#section-3.1.2"
                              Location="https://openidconnect.net/callback"
                              index="1"/>
    </SPSSODescriptor>
  </EntityDescriptor>


However, when I try and test, I get the error "InvalidRedirectionURI", with
this in the logs:

2023-11-08 19:44:12,867 - 10.104.223.125/node01nmiq8hqzra4b86jo4p836hv820 - WARN [net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateRedirectURI:118] - Profile Action ValidateRedirectURI: Client has not registered Redirection URIs. Redirection URI cannot be validated.

I know it's getting the xml metadata, as if I try to use any other client id,
it gives an "The application you have accessed is not registered for use
with this service" error.

Looking at the underlying code in ClientInformationNodeProcessor.java,
the URI's are populated by parseRedirectUris, which is called by
populateMetadata. My metadata has an AssertionConsumerService with
a binding matching BINDING_ID_REDIRECT_URI, so I'm not sure why
it's not being registered?

What simple thing am I missing this time 8-/?


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768