OIDC OP dynamic discovery

[Henri Mikkonen]

Hi Raymond,

Double check that the value of value of 'idp.oidc.issuer' in 
conf/oidc.properties matches the 'issuer' value in 
static/openid-configuration.json.

The match must be exact: same case, no trailing white-spaces, etc.

BR,
Henri.

On 23.7.2026 0.09, Raymond Drew Walker via users wrote:
> When attempting to configure IDP 5.2.3 with the OP (oidc) plugin:
> Plugin: net.shibboleth.oidc.common      Current Version: 3.3.0
> Plugin: net.shibboleth.idp.plugin.oidc.op       Current Version: 4.3.1
> Plugin: net.shibboleth.idp.plugin.oidc.config   Current Version: 3.0.1
> 
> I believe I've followed all the documentation as appropriate but am 
> getting stumped on debugging this one…
> 
>   *
>     redirect is working as expected via:
>     RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/
>     configuration [L]
>   *
>     Using the basic static/openid-configuration.json (with our OP issuer
>     replacing  {{ service_name }} )
>   * can hit idp/profile/oidc/keyset so I believe OP metadata is not a
>     problem
>   *
>     dynamic configured discovery ie. <ref bean="OIDC.Configuration" />
>     in shibboleth.UnverifiedRelyingParty
> 
> 
> I'm running into an interesting error when attempting to resolve the 
> discovery url ".well-known/openid-configuration" :
> {
> "error_description": "InputOutputError",
> "error": "server_error"
> }
> 
> logs appear as:
> 2026-07-22 14:03:51,581 - 192.168.65.3 - DEBUG 
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext:68] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context
> 2026-07-22 14:03:51,582 - 192.168.65.3 - DEBUG 
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:77] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached
> 2026-07-22 14:03:51,586 - 192.168.65.3 - WARN 
> [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria
> 2026-07-22 14:03:51,586 - 192.168.65.3 - ERROR 
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:86] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata
> 2026-07-22 14:03:51,588 - 192.168.65.3 - WARN 
> [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event 
> occurred while processing the request: InputOutputError
> 2026-07-22 14:03:51,592 - 192.168.65.3 - INFO [Shibboleth- 
> Audit.OIDC.Configuration:333] - 192.168.65.3|| 
> 2026-07-22T21:03:51.592613210Z|||http://shibboleth.net/ns/profiles/oidc/ 
> configuration|||||||||||||JSONErrorResponse|||||||Mozilla/5.0 
> (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like 
> Gecko) Chrome/150.0.0.0 Safari/537.36|
> 
> Unsure how to debug at this point, I’ve already been down a few AI led 
> rabbit-holes after exhausting my own resources...
> 
> -- 
> Raymond Walker
> Software Systems Engineer Lead
> Enterprise Identity & Platform Engineering
> ITS Northern Arizona University
>