OIDC secrets in ldap and resolutionPhases

Paul B. Henson henson at cpp.edu
Sat Nov 11 01:26:54 UTC 2023


I'm configuring my idp to resolve OIDC secrets from ldap. However, when
I try and restrict the relevant DataConnector's to only run when needed,
I get a warning:

<DataConnector id="LDAP-OIDC"
  xsi:type="LDAPDirectory"
  resolutionPhases="ResolverServiceClientSecretValueResolver"

2023-11-10 17:16:21,681 - / - WARN [net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter:52] - Unrecognized value 'ResolverServiceClientSecretValueResolver' converted to false; if intentional, explicitly use 'false'


On the other hand, when I use the opposite config to keep my other data
connectors from running in that phase:

excludeResolutionPhases="ResolverServiceClientSecretValueResolver"

It works fine, as before I added that couple were complaining:

2023-11-10 17:14:55,399 - / - ERROR [idp_authz:127] - RelyingPartyContext null, failing open

2023-11-10 17:10:24,799 - / - WARN [net.shibboleth.idp.attribute.resolver.dc.impl.PairwiseIdDataConnector:257] - Data Connector 'computedSubjectId': Could not get attribute issuer ID, skipping ID creation

and adding it to those fixed those logs.


Both "excludeResolutionPhases" and "resolutionPhases" are documented as
"List of resolution phases". How come when I try and use the latter it
gives an odd error, while the former with the same value works fine?

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768


More information about the users mailing list