OIDC OP dynamic discovery

[Raymond Drew Walker]

Trailing whitespace in idc.properties was the culprit.

TYVM.

--
Raymond Walker
Software Systems Engineer Lead
Enterprise Identity & Platform Engineering
ITS Northern Arizona University
From: users <users-bounces at shibboleth.net> on behalf of Henri Mikkonen <henri.mikkonen at nimbleidm.com>
Date: Thursday, July 23, 2026 at 2:02 AM
To: users at shibboleth.net <users at shibboleth.net>
Subject: Re: OIDC OP dynamic discovery

Hi Raymond,

Double check that the value of value of 'idp.oidc.issuer' in
conf/oidc.properties matches the 'issuer' value in
static/openid-configuration.json.

The match must be exact: same case, no trailing white-spaces, etc.

BR,
Henri.

On 23.7.2026 0.09, Raymond Drew Walker via users wrote:
> When attempting to configure IDP 5.2.3 with the OP (oidc) plugin:
> Plugin: net.shibboleth.oidc.common      Current Version: 3.3.0
> Plugin: net.shibboleth.idp.plugin.oidc.op       Current Version: 4.3.1
> Plugin: net.shibboleth.idp.plugin.oidc.config   Current Version: 3.0.1
>
> I believe I've followed all the documentation as appropriate but am
> getting stumped on debugging this one…
>
>   *
>     redirect is working as expected via:
>     RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/
>     configuration [L]
>   *
>     Using the basic static/openid-configuration.json (with our OP issuer
>     replacing  {{ service_name }} )
>   * can hit idp/profile/oidc/keyset so I believe OP metadata is not a
>     problem
>   *
>     dynamic configured discovery ie. <ref bean="OIDC.Configuration" />
>     in shibboleth.UnverifiedRelyingParty
>
>
> I'm running into an interesting error when attempting to resolve the
> discovery url ".well-known/openid-configuration" :
> {
> "error_description": "InputOutputError",
> "error": "server_error"
> }
>
> logs appear as:
> 2026-07-22 14:03:51,581 - 192.168.65.3 - DEBUG
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext:68] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context
> 2026-07-22 14:03:51,582 - 192.168.65.3 - DEBUG
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:77] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached
> 2026-07-22 14:03:51,586 - 192.168.65.3 - WARN
> [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria
> 2026-07-22 14:03:51,586 - 192.168.65.3 - ERROR
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:86] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata
> 2026-07-22 14:03:51,588 - 192.168.65.3 - WARN
> [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event
> occurred while processing the request: InputOutputError
> 2026-07-22 14:03:51,592 - 192.168.65.3 - INFO [Shibboleth-
> Audit.OIDC.Configuration:333] - 192.168.65.3||
> 2026-07-22T21:03:51.592613210Z|||http://shibboleth.net/ns/profiles/oidc/
> configuration|||||||||||||JSONErrorResponse|||||||Mozilla/5.0
> (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like
> Gecko) Chrome/150.0.0.0 Safari/537.36|
>
> Unsure how to debug at this point, I’ve already been down a few AI led
> rabbit-holes after exhausting my own resources...
>
> --
> Raymond Walker
> Software Systems Engineer Lead
> Enterprise Identity & Platform Engineering
> ITS Northern Arizona University
>

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260723/1f455a98/attachment.htm>