[ISTA-Suspicious] Re: OIDC plugin credential validator failed

[David Stava]

Hi Henry,


> If you enable full logging to protocol messages in logback.xml:

> <logger name="PROTOCOL_MESSAGE.OAUTH2" level="ALL" />

> Then you'll get full information of the request message contents from
> client to the token endpoint. There you can see the value for
> Authorization-header which you can decode yourself to check whether it
> contains the same secret value that you've configured in the metadata.


many thanks for this useful information. There was a special character in the client secret which was causing issues. After replacing it the client authenticates successfully. I wish you happy holidays!


Best,


David Stava




________________________________
From: users <users-bounces at shibboleth.net> on behalf of Henri Mikkonen <henri.mikkonen at nimbleidm.com>
Sent: Thursday, December 19, 2024 2:00:42 PM
To: users at shibboleth.net
Subject: [ISTA-Suspicious] Re: OIDC plugin credential validator failed

[EXTERNAL EMAIL - USE CAUTION when clicking links or attachments]


Hi David,

On 19.12.2024 14.46, David Stava via users wrote:
> I'm trying to setup the first RP and get an error that client
> authentication failed.
>
> 2024-12-19 13:23:41,224 - INFO
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.OIDCClientInfoCredentialValidator:167] - Credential Validator oauth2-clientinfo: Login by 'rp-test' failed
> 2024-12-19 13:23:41,225 - DEBUG
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.JWTCredentialValidator:168] - Credential Validator oauth2-jwt: OAuth client authentication for 'rp-test' of unsupported type: client_secret_basic

Those are the expected log-lines if the client secret is wrong in the
incoming request.

The second log-line is not really an error: it's a debug-line that
simply tells that JWTCredentialValidator isn't going to proceed as the
client authentication was client_secret_basic.

If you enable full logging to protocol messages in logback.xml:

<logger name="PROTOCOL_MESSAGE.OAUTH2" level="ALL" />

Then you'll get full information of the request message contents from
client to the token endpoint. There you can see the value for
Authorization-header which you can decode yourself to check whether it
contains the same secret value that you've configured in the metadata.

BR,
Henri.
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241220/9cc208ac/attachment.htm>