OIDC Unauthorized client error

[Mathew, Sunil]

Hi,

I am testing the OIDC setup using oidcdebugger.com.

Here are my configurations:

oidc-client.json:

{

"client_id": "oidc-debugger",

"client_secret": “client-secret",

"scope": "openid email profile",

"redirect_uris": ["https://oidcdebugger.com/debug"],

"response_types": ["code"],

"grant_types": ["authorization_code"],

"token_endpoint_auth_method": "client_secret_basic"

}

relying-party.xml:

<!--

Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list

to enable specific default profile settings (as below), or create new beans inline to override defaults.

"Unverified" typically means the IdP has no metadata, or equivalent way of assuring the identity and

legitimacy of a requesting system. To run an "open" IdP, you can enable profiles here.

-->

<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">

<property name="profileConfigurations">

<list>

<!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->

</list>

</property>

</bean>


<!--

Default configuration, with default settings applied for all profiles.

Take care with any defaults you apply at this level because you will have to create

overrides or apply metadata tags for every single SP that requires a different setting.

Changed defaults should be things you really do want to apply to nearly every SP.

-->

<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">

<property name="profileConfigurations">

<list>

<!-- SAML 1.1 and SAML 2.0 AttributeQuery are disabled by default. -->

<!--

<ref bean="Shibboleth.SSO" />

<ref bean="SAML1.AttributeQuery" />

<ref bean="SAML1.ArtifactResolution" />

-->

<ref bean="SAML2.SSO" />

<ref bean="SAML2.ECP" />

<ref bean="SAML2.Logout" />

<!--

<ref bean="SAML2.AttributeQuery" />

-->

<ref bean="SAML2.ArtifactResolution" />

<!-- Add OIDC discovery/keyset support -->

<ref bean="OIDC.Configuration" />

<ref bean="OIDC.Keyset" />

</list>

</property>

</bean>


<!-- Container for any overrides you want to add. -->


<util:list id="shibboleth.RelyingPartyOverrides">


<!-- OIDC Debugger -->

<bean parent="RelyingPartyByName" c:relyingPartyIds="oidc-debugger">

<property name="profileConfigurations">

<list>

<ref bean="OIDC.SSO" />

<bean parent="OAUTH2.Token" p:authorizationCodeFlowEnabled="true" />

<ref bean="OIDC.UserInfo"/>

<ref bean="OIDC.Keyset" />

<ref bean="OAUTH2.TokenAudience"/>

<ref bean="OAUTH2.Revocation"/>

<ref bean="OAUTH2.Introspection" />

</list>

</property>

</bean>

Here is my curl command to exchange code for tokens:
curl -X POST https://ssodev.hbsstg.org/idp/profile/oidc/token \
  -u "oidc-debugger:client-secret" \
  -d "grant_type=authorization_code" \
  -d “code=auth-code" \
  -d "redirect_uri=https://oidcdebugger.com/debug”


I have also tried OIDC.SSO instead of OAUTH2.Token, but that did not help:
<bean parent="OIDC.SSO" p:authorizationCodeFlowEnabled="true" />

Can you please let me know what the issue could be?


Regards,
Sunil

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260706/96945dc2/attachment.htm>