OIDC plugin credential validator failed

[Henri Mikkonen]

Hi David,

On 19.12.2024 14.46, David Stava via users wrote:
> I'm trying to setup the first RP and get an error that client 
> authentication failed.
> 
> 2024-12-19 13:23:41,224 - INFO 
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.OIDCClientInfoCredentialValidator:167] - Credential Validator oauth2-clientinfo: Login by 'rp-test' failed
> 2024-12-19 13:23:41,225 - DEBUG 
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.JWTCredentialValidator:168] - Credential Validator oauth2-jwt: OAuth client authentication for 'rp-test' of unsupported type: client_secret_basic

Those are the expected log-lines if the client secret is wrong in the 
incoming request.

The second log-line is not really an error: it's a debug-line that 
simply tells that JWTCredentialValidator isn't going to proceed as the 
client authentication was client_secret_basic.

If you enable full logging to protocol messages in logback.xml:

<logger name="PROTOCOL_MESSAGE.OAUTH2" level="ALL" />

Then you'll get full information of the request message contents from 
client to the token endpoint. There you can see the value for 
Authorization-header which you can decode yourself to check whether it 
contains the same secret value that you've configured in the metadata.

BR,
Henri.