Having trouble loading a key-value map for selecting upstream OIDC OP

[Zhang, Jianjun]

Hi,

I want to load a configuration map on the shibboleth OIDC proxy that specifies which downstream client uses which upstream OIDC OP. Then from the requester's client_id a nashorn script returns the OP issuer string from the map. I have no problem doing this for SAML where downstream client entityIDs are mapped to upstream SAML idp entityIDs. I have this in the global.xml for SAML. But when I do the similar for OIDC using shibboleth.authn.oidc.rp.discoveryFunction, it complains it can't see the map. I tried moving this part to client-rp-config.xml, it gives the same error.

The simple map is like this:
<util:map id="rpOpMap:>
               <entry key="oidc_client_id1" value="https://upstream-op-issuer1"/>
<entry key="oidc_client_id2" value="https://upstream-op-issuer2"/>
</util:map>

The script part:
<bean id="shibboleth.authn.oidc.rp.discoveryFunction" parent="shibboleth.ContextFunctions.Scripted"
               factory-method="inlineScript"
               c:outputType="java.lang.String"
               p:customObject-ref="rpOpMap">
               <constructor-arg name="scriptSource">
                              <value>
                                             <![DATA[
                                                            .....

It just says it can't resolve "rpOpMap". For SAML, I use "shibboleth.authn.SAML.discoveryFunction", then it has no problem.
Is this the right way to do it for OIDC? This is shibboleth v5.2.1.

Thanks,

Johnny

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260413/903e6f63/attachment.htm>