OIDC OP dynamic discovery

[Raymond Drew Walker]

When attempting to configure IDP 5.2.3 with the OP (oidc) plugin:
Plugin: net.shibboleth.oidc.common      Current Version: 3.3.0
Plugin: net.shibboleth.idp.plugin.oidc.op       Current Version: 4.3.1
Plugin: net.shibboleth.idp.plugin.oidc.config   Current Version: 3.0.1

I believe I've followed all the documentation as appropriate but am getting stumped on debugging this one…


  *
redirect is working as expected via:
RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/configuration [L]
  *
Using the basic static/openid-configuration.json (with our OP issuer replacing  {{ service_name }} )
  *   can hit idp/profile/oidc/keyset so I believe OP metadata is not a problem
  *
dynamic configured discovery ie. <ref bean="OIDC.Configuration" /> in shibboleth.UnverifiedRelyingParty

I'm running into an interesting error when attempting to resolve the discovery url ".well-known/openid-configuration" :
{
"error_description": "InputOutputError",
"error": "server_error"
}

logs appear as:
2026-07-22 14:03:51,581 - 192.168.65.3 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext:68] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context
2026-07-22 14:03:51,582 - 192.168.65.3 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:77] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached
2026-07-22 14:03:51,586 - 192.168.65.3 - WARN [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria
2026-07-22 14:03:51,586 - 192.168.65.3 - ERROR [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:86] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata
2026-07-22 14:03:51,588 - 192.168.65.3 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InputOutputError
2026-07-22 14:03:51,592 - 192.168.65.3 - INFO [Shibboleth-Audit.OIDC.Configuration:333] - 192.168.65.3||2026-07-22T21:03:51.592613210Z|||http://shibboleth.net/ns/profiles/oidc/configuration|||||||||||||JSONErrorResponse|||||||Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36|

Unsure how to debug at this point, I’ve already been down a few AI led rabbit-holes after exhausting my own resources...

--
Raymond Walker
Software Systems Engineer Lead
Enterprise Identity & Platform Engineering
ITS Northern Arizona University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260722/a7973d79/attachment.htm>