Configuring OIDC to use client_credentials - InvalidMessageContext

[Henri Mikkonen]

Hi Gary,

Ah, now I see how you've defined the audience in the metadata:

On 4.9.2024 6.25, Lipscomb, Gary wrote:
>          <oidcmd:OAuthRPExtensions
>            grant_types="client_credentials"
>            response_types="token"
>            token_endpoint_auth_method="client_secret_post"
>            scopes="profile"
>            saml:Audience="https://REDACTED.csu.edu.au/restapi/" >
>        </oidcmd:OAuthRPExtensions>

It's supposed to be in a child element, not as an attribute like you've 
done.

This should work:

<oidcmd:OAuthRPExtensions
    grant_types="client_credentials"
    response_types="token"
    token_endpoint_auth_method="client_secret_post"
    scopes="profile">
    <saml:Audience>https://REDACTED.csu.edu.au/restapi/</saml:Audience>
  </oidcmd:OAuthRPExtensions>

BR,
Henri.