Debugging SAML to OIDC ACR proxying

[Wessel, Keith]

Hi, all,

We're once again trying to switch our Shibboleth to Entra proxying to use OIDC instead of SAML, and my mapping of SAML ACRs to corresponding OIDC ACRs configured for our entra tenant isn't working as expected. Simple question: what logging class can I turn up that would show me the ACR being sent to Microsoft in the request? And what class would show me what's coming back? net.shibboleth.idp.plugin.authn.oidc.rp.impl set to DEBUG is showing me all the standard claims being mapped to attributes in the IdP as well as claims from Microsoft that are being dropped due to lack of a transcoding rule. But if I understand this stuff correctly, acr is kind of a special beast. I'd really like to see the low-level decoded JSON tokens if I can.

Thanks,
Keith