Authenticating with OAuth2?

[Wessel, Keith]

Thanks, Scott. I think I'm on the latest stable versions of the plugins, at least for IdP V4. Planning to upgrade to IdP 5 next month if that will fix this. Wasn't sure if there were newer versions that don't work with IdP V4.

I'm getting this in the log when I don't include the scope parameter.

2024-05-30 12:56:07,162 - WARN [net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateAuthorizationRequestType:73] - Profile Action ValidateAuthorizationRequestType: The request did not match with the configured authorization request type requirements

I'm on:

Plugin: net.shibboleth.oidc.common      Current Version: 2.2.1
Plugin: net.shibboleth.idp.plugin.oidc.config   Current Version: 1.0.1
Plugin: net.shibboleth.idp.plugin.oidc.op       Current Version: 3.4.0

For giggles,I tried this with my IdP V5 sandbox and got the samelog warning and erroring the browser. Plugin versions were:

Plugin: net.shibboleth.idp.plugin.oidc.config   Current Version: 2.1.0
Plugin: net.shibboleth.idp.plugin.oidc.op       Current Version: 4.1.0
Plugin: net.shibboleth.oidc.common      Current Version: 3.1.0

Am I missing something?

Thanks,
Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Thursday, May 30, 2024 11:32 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Authenticating with OAuth2?

> Since his library is using pure OAuth2, he can't add a scope
> parameter to the request.

Scope is an OAuth2 concept, not an OpenID one. What makes an OAuth authorization request an OpenID request is the openid scope. The concept of scope is just core to OAuth so far as I understand it.

I think there's a bug in some of our flows though that don't allow omitting scope, Henri just fixed something there I think. Not sure about the authorization flow though.

Anyway, it's a bug.

The terminology and classes and all that are messy because we added OAuth support afterwards, but the "OIDC" endpoint is a pure OAuth endpoint, modulo bugs.

-- Scott