[External] Re: OIDC for Mobile App

[Hall, Gerry]

Scott,
There is no client metadata for the OIDC services.  The extent of the config is below.  I have several OIDC services working but this is the first for a mobile app and the first that does not want a client secret.

{
  "client_id": “FooMobileApp",
  "response_types": ["code"],
  "scope": "openid profile email offline_access",
  "redirect_uris": [“foo.mobile://oauthredirect/"],
  "token_endpoint_auth_method": "none",
  "pkce_required": true,
  "application_type": "native",
  "grant_types": ["authorization_code"]
}



From: Cantor, Scott <cantor.2 at osu.edu>
Date: Wednesday, August 6, 2025 at 11:46 AM
To: Shib Users <users at shibboleth.net>
Cc: Hall, Gerry <gerry.hall at emory.edu>
Subject: [External] Re: OIDC for Mobile App

If you want no secret then you need to change your client metadata, in whatever format, to reflect what client authn methods you want to allow, namely "none" I believe.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250806/536fdf8e/attachment.htm>