OIDC RP plugin not finding client ID

[Philip Smart]

On 21 Mar 2025, at 10:59, Philip Smart <Philip.Smart at jisc.ac.uk> wrote:

Hi Keith,

I'm obviously overlooking something very basic here.

I've got a fairly vanilla installation of the OIDC RP plugin that I want to use to proxy to a single OP.

I've set idp.authn.oidc.rp.provider.proxyIssuer, and the IdP is successfully fetching OP metadata according to the log.

I've set idp.authn.oidc.rp.client.clientId and idp.authn.oidc.rp.client.clientSecret and even explicitly set idp.authn.oidc.rp.provider.discoveryRequired=false to be sure. And, even though it shouldn't matter, I've removed spaces from the equal signs in any of these properties though I know the IdP will trim whitespace.

But still, the log tells me this when I try to authenticate:

ERROR [net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientContext:156] - Profile Action InitializeOAuth2ClientContext: No client_id found from profile configuration

Any thoughts where else to look? I'm feeling rather silly at the moment that I can't get this working.


This all looks sensible to me, would you be able to tell me the versions of the net.shibboleth.oidc.common and net.shibboleth.idp.plugin.oidc.config plugins you have installed?

shibboleth-idp/bin/plugin.sh -l

Phil

Also, could you try to add the client_id as a relying party override (should not need this, but just to help understand why it is not being wired up):

<util:list id="shibboleth.RelyingPartyOverrides">

        <bean id=“openidprovider" parent="RelyingPartyByName" c:relyingPartyIds=“<idp.authn.oidc.rp.provider.proxyIssuer>">
            <property name="profileConfigurations">
              <list>
                  <bean parent="OIDC.SSO" p:clientId="client_id"/>
              </list>
           </property>
         </bean>

    </util:list>

Phil



Thanks,
Keith



Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250321/9970e6d0/attachment.htm>