Oidc revocation token - bad request - No security parameters context is available

[Domenico Cervino]

Hi,
the strange thing is that during the access token request the jwt keys were resolved because we built the request by signing the client_assertion in the same way except for "aud" value.
We have configured the RP metadata in the file idp_home/metadata/oidc-client.json.
The one (with private_key_jwt) for which we get "400 Bad request" when trying to revoke the token is configured like this, is there some error or macroscopic lack?
  
  {
    "scope":"openid offline_access",
    "redirect_uris":["uri1","uri2","urin"],
    "client_id":"omitted",
    "jwks":{"keys":[
           {
			"kty": "EC",
			"use": "sig",
			"crv": "P-256",
			"x": "omitted",
			"y": "omitted",
			"alg": "ES256"
			}
		]
	},
	"token_endpoint_auth_method":"private_key_jwt",
    "response_types":["code"],
    "grant_types":["authorization_code"]
  }
  
In relying-party.xml we have added <ref bean="OAUTH2.Revocation"/> for DefaultRelyingParty.
It may be useful to note that for a simple RP (without jwt) with only client - secret we manage to revoke the token by obtaining 200 from the call to the revocation endpoint:
  
  {
    "scope":"openid email",
    "redirect_uris":["uri1","uri2","urin"],
    "client_id":"omitted",
    "client_secret":"topsecret",
    "response_types":["code"],
    "grant_types":["authorization_code"]
  }
  
  (obviously in this simpler case the authentication is of type basic authorization in the header instead of being managed with client_assertion and client_assertion_type).

Thanks
Domenico

> Il 22/03/2024 15:57 CET Cantor, Scott <cantor.2 at osu.edu> ha scritto:
> 
>  
> My guess would be that there's no metadata available for it to establish the key(s) allowed to verify the signature on the request.
> 
> Just a guess though.
> 
> -- Scott