OIDC RP plugin not finding client ID

[Wessel, Keith]

For what it’s worth, I had to explicitly add the client secret to the RP override to make it work. When I responded earlier, I hadn’t completed logging in so hadn’t gotten to that point yet. But things like the issuer and even the increased clock skew (silly Microsoft) are getting picked up from oidc-rp.properties.

Keith


From: Wessel, Keith
Sent: Friday, March 21, 2025 9:41 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: OIDC RP plugin not finding client ID

Hey, Philip,

Funny you should suggest that test. As I was heading to my office this morning, it occurred to me that I should try that exact test of directly adding the client ID as an RP override. Sure enough, that worked. Not sure why the value from oidc-rp.properties file is being ignored. Clearly, it’s picking up the issuer and client secret from that file.

For plugin versions, here’s everything OIDC and OUaht2 related. It’s a fresh Docker build, so everything should be the latest.

/opt/shibboleth-idp/bin/plugin.sh -L |grep oidc
Plugin net.shibboleth.idp.plugin.oidc.config: Installed version 2.2.0: No update available
Plugin net.shibboleth.idp.plugin.oidc.op: Installed version 4.2.1: No update available
Plugin net.shibboleth.idp.plugin.authn.oidc.rp: Installed version 2.1.2: No update available
Plugin net.shibboleth.oidc.common: Installed version 3.2.0: No update available

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Philip Smart via users
Sent: Friday, March 21, 2025 6:51 AM
To: users at shibboleth.net
Cc: Philip Smart <Philip.Smart at jisc.ac.uk>
Subject: Re: OIDC RP plugin not finding client ID



On 21 Mar 2025, at 10:59, Philip Smart <Philip.Smart at jisc.ac.uk> wrote:

Hi Keith,

I'm obviously overlooking something very basic here.



I've got a fairly vanilla installation of the OIDC RP plugin that I want to use to proxy to a single OP.



I've set idp.authn.oidc.rp.provider.proxyIssuer, and the IdP is successfully fetching OP metadata according to the log.



I've set idp.authn.oidc.rp.client.clientId and idp.authn.oidc.rp.client.clientSecret and even explicitly set idp.authn.oidc.rp.provider.discoveryRequired=false to be sure. And, even though it shouldn't matter, I've removed spaces from the equal signs in any of these properties though I know the IdP will trim whitespace.

But still, the log tells me this when I try to authenticate:



ERROR [net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientContext:156] - Profile Action InitializeOAuth2ClientContext: No client_id found from profile configuration



Any thoughts where else to look? I'm feeling rather silly at the moment that I can't get this working.

This all looks sensible to me, would you be able to tell me the versions of the net.shibboleth.oidc.common and net.shibboleth.idp.plugin.oidc.config plugins you have installed?

shibboleth-idp/bin/plugin.sh -l

Phil

Also, could you try to add the client_id as a relying party override (should not need this, but just to help understand why it is not being wired up):

<util:list id="shibboleth.RelyingPartyOverrides">

        <bean id=“openidprovider" parent="RelyingPartyByName" c:relyingPartyIds=“<idp.authn.oidc.rp.provider.proxyIssuer>">
            <property name="profileConfigurations">
              <list>
                  <bean parent="OIDC.SSO" p:clientId="client_id"/>
              </list>
           </property>
         </bean>

    </util:list>

Phil



Thanks,

Keith


Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice<https://urldefense.com/v3/__https:/www.jisc.ac.uk/website/privacy-notice__;!!DZ3fjg!9Ix9p4zDHFNNdwRbNBWIcCMtPAca2PZswcukrgMbcSu9ny8Ule0Vd-4Tinu_yRv2ISZNFUwIifFngCZQW4p7$>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250321/ca90a84a/attachment.htm>