Configuring OIDC to use client_credentials - InvalidMessageContext

[Henri Mikkonen]

Hi Gary,

On 3.9.2024 4.07, Lipscomb, Gary via users wrote:
> curl -k --location https://idpqa.csu.edu.au/idp/profile/oidc/token 
> --header "Content-Type: application/x-www-form-urlencoded" 
> --data-urlencode grant_type=client_credentials --data-urlencode 
> client_id=https://REDACTED.csu.edu.au/oidc --data-urlencode 
> client_secret=REDACTED_SECRET --data-urlencode 
> audience=https://REDACTED.csu.edu.au/restapi --data-urlencode scope=profile
> 
> {"error":"invalid_target","error_description":"Improper or disallowed 
> resource indicator"}

The correct parameter-name is 'resource', not 'audience'. See 
https://datatracker.ietf.org/doc/html/rfc8707

> *saml:Audience="https://REDACTED.csu.edu.au/restapi" />*

Do you also have a trusted metadata entry for 
'https://REDACTED.csu.edu.au/restapi'?

As you seem to be using SAML metadata, you need a specific 
EntityDescriptor entry for it. A minimal example with the scope that you 
used in the curl-command above:

<md:EntityDescriptor entityID="https://REDACTED.csu.edu.au/restapi">
   <md:SPSSODescriptor 
xmlns:oidcmd="urn:mace:shibboleth:metadata:oidc:1.0" 
protocolSupportEnumeration="http://openid.net/specs/openid-connect-core-1_0.html">
     <md:Extensions>
       <oidcmd:OAuthRPExtensions
         scopes="profile">
       </oidcmd:OAuthRPExtensions>
     </md:Extensions>
   </md:SPSSODescriptor>
</md:EntityDescriptor>

BR,
Henri.