OIDC and dynamic ports on the metadata redirect_uris?

[Henri Mikkonen]

On 23.1.2026 23.12, Bryan K. Walton via users wrote:
> I've been trying to find a way in our OIDC metadata on the IdP to
> specify a wildcard for the port.  Our redirect_uris field is using
> the loopback interface, http://127.0.0.1.
> According to RFC 8252 (section 7.3):
> 
> "The authorization server MUST allow any port to be specified at the
>     time of the request for loopback IP redirect URIs, to accommodate
>     clients that obtain an available ephemeral port from the operating
>     system at the time of the request."
> 
> Source: https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
> 
> Does the Shibboleth IdP support this feature?  If so, what should I be
> using for the port wildcard in the metadata?

Hi Bryan,

We don't support wildcards in the metadata, but if I understand you 
correctly you should be able to tackle that requirement via the 
following profile configuration option: 
customRedirectUriValidationStrategy, see:

https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3947823106/OPCustomRedirectUriValidation

BR,
Henri.