Using OpenID with Sogo + dovecot / Adding a secondary aud claim to OpenID access tokens

[Max Nuding]

Hi!

We're currently testing out adding OIDC support to our Shibboleth IdP at 
version 5.1.4, and the first client we want to test is SoGo, our webmail 
interface.

SoGo requests an access token and forwards that to out IMAP server 
(dovecot 2.3.21), which then uses that token to make a call to 
/idp/profile/oauth2/introspection. This is causing a problem: Shibboleth 
IdP is complaining about invalid audiences, because the client that's 
using the access token for the introspection endpoint is different from 
the client the token was issued to.

Is it possible to configure out IdP, so that it addds an additional 
client Id to the audience claim?

Another option would be, to configure dovecot and SoGo with the same 
client id/secret, so that it apears to be the same client. This won't 
work, because SoGo insists on using client_secret_post and dovecot 
insits on using client_secret_basic, and the IdP verifies that the used 
method is the same as the registered one.

Is it possible to make an exception for this specific client?

Are there any opther options I'm missing?

Thanks!
Max


-- 
Herr Max Nuding
Softwareentwickler / Abt. IT-Dienste für Forschung und Lehre
Kommunikations-, Informations-, Medienzentrum (KIM)
Universität Konstanz
78457 Konstanz
Tel.: +49.7531.88-4658
Raum: B 707

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5056 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20250612/5f365fef/attachment.p7s>