OIDC OP Plugin "issues"

[Lazar, Michael E]

Hello everyone,

I'm running into a bit of difficulty getting the OIDC OP plugin working (Plugin v4.1.0 on IdP 5.1.2). Granted I'm new to this protocol (other than being a user) so any advice (or code snippets) is welcomed.

I have one SP that seems to be making it to the OIDCTokenResponse yet presents me with a (terse) error about inability to obtain a refresh token.
For the sake of troubleshooting the server-to-server side of things, I stood up the example node.js app with passport's openidconnect module, and an example repo with a "working demo."

After I enter creds (I do see a login screen), I get an "Invalid Event" message out of the node app with an IdP log stub:

WARN [net.shibboleth.idp.plugin.oidc.op.authn.impl.ValidateClientAuthenticationType:169] - Profile Action ValidateClientAuthenticationType: Client '********' registered client_secret_basic but attempted
client_secret_post

I'm pretty close to the setup documentation, but understand little in the way of changing things. Same result happened when I explicitly uncommented the tokenEndpointAuthMethods props in the oidc.properties file.

Looking for insights; Anyone else seen this? How are you all diagnosing and troubleshooting the server-to-server leg of the protocol?

Hope everyone has a great week,
-Michael.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250224/a847302a/attachment.htm>