Configuring OIDC to use client_credentials - InvalidMessageContext

[Henri Mikkonen]

On 30.8.2024 8.44, Lipscomb, Gary wrote:
> Hi Henri,
> 
> Still no success
> 
> I'm using this to test
> 
> curl --location https://REDACTED/idp/profile/oidc/token --header 
> "Content-Type: application/x-www-form-urlencoded" --header "Accept: 
> application/json" --data-urlencode grant_type=client_credentials 
> --data-urlencode client_id=https://REDacted/oidc --data-urlencode 
> client_secret=VERY_VERY_SECRET  --data-urlencode scope=openid

That's expected as you still seem to have the scope=openid in the 
parameters. You shouldn't use that specific scope with any non-OIDC 
sequence such as client_credentials grant.

I filed an issue about it 
https://shibboleth.atlassian.net/browse/JOIDC-224 to improve logging. 
But in any case, you need to add the audience to the client metadata in 
order to have a target for the access token to be issued with the client 
credentials grant.

BR,
Henri.