[External Email] Re: disable oauth2-jwt

[Jeffrey J Ramsay]

Hello -

I believe I found the problem, but I'm unsure where / how to resolve it. I
am using the PHP JumbojettOpenIDConnectClient client to test and have set
the token_endpoint as listed in our well-known services; however, when
passed and decoded by Shibboleth, it resolves to the server non-routable
address, as shown below in the endpointURL. The redirectionURI is not
affected by whatever is occurring.

PHP var_dump excerpt:
["token_endpoint"]=> string(56) "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token" }

idp-process.log excerpt:
DEBUG [PROTOCOL_MESSAGE.OAUTH2:114] -
OIDCTokenRequestDecoder{authorizationGrant=AuthorizationCodeGrant{authorizationCode=ZZZZ,
redirectionURI=https://idp-dev.cc.binghamton.edu/openid-client/index.php,
type=authorization_code},
clientAuthentication=ClientAuthentication{clientId=
https://casidp1-dev.cc.binghamton.edu, method=client_secret_basic},
customParameters={}, endpointURI=
https://172.31.56.111/idp/profile/oidc/token}

Well-known service definitions:
  "issuer": "https://idp-dev.cc.binghamton.edu",
  "authorization_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/authorize",
  "registration_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/register",
  "token_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token",
  "userinfo_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/userinfo",
  "introspection_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/introspection",
  "revocation_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/revocation",
  "jwks_uri": "https://idp-dev.cc.binghamton.edu/idp/profile/oidc/keyset",
  "end_session_endpoint": "
https://idp-dev.cc.binghamton.edu/idp/profile/oidc/end-session",

-Jeff

On Thu, Sep 19, 2024 at 3:25 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> The bulk of the docs on client authentication as handled by the expected
> flow is in
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2929033287/OAuth2ClientAuthnConfiguration
>
> It assumes you know what you want to do though, in very precise technical
> fashion, like "I want to hash secrets and stuff them into metadata fles for
> testing" or "I want to use service accounts and LDAP to authenticate
> clients, and then use an attribute in LDAP to derive the actual client_id
> for the OAuth layer".
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240919/2e6ae15d/attachment.htm>