Debugging SAML to OIDC ACR proxying

[Bobby Lawrence]

I had to register a custom bean (shibboleth.authn.oidc.rp.idtoken.IDTokenLookupStrategy) to log that information because I couldn't find a way to make the default implementation do it.
Something like this in oidc-rp-config.xml:

<bean id="shibboleth.authn.oidc.rp.idtoken.IDTokenLookupStrategy" scope="prototype"
        class="my.custom.package.CustomIDTokenLookupStrategy" />

Then a Java class like this:

package my.custom.package;

public class CustomIDTokenLookupStrategy extends net.shibboleth.idp.plugin.authn.oidc.rp.context.navigate.DefaultIDTokenLookupStrategy {

  @Nonnull
  private final Logger log = LoggerFactory.getLogger(this.getClass());

  @Override
  @Nullable
  public JWT apply(@Nullable final ProfileRequestContext prc) {
    JWT idToken = super.apply(prc);
    if (idToken != null) {
      try {
        log.debug("idToken claims: " + idToken.getJWTClaimsSet().getClaims());
      }
      catch (ParseException e) {
        e.printStackTrace();
      }
    }
    return idToken;
  }
}


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Wessel, Keith via users <users at shibboleth.net>
Sent: Thursday, March 5, 2026 12:21 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: [EXTERNAL] Debugging SAML to OIDC ACR proxying

Hi, all,

We're once again trying to switch our Shibboleth to Entra proxying to use OIDC instead of SAML, and my mapping of SAML ACRs to corresponding OIDC ACRs configured for our entra tenant isn't working as expected. Simple question: what logging class can I turn up that would show me the ACR being sent to Microsoft in the request? And what class would show me what's coming back? net.shibboleth.idp.plugin.authn.oidc.rp.impl set to DEBUG is showing me all the standard claims being mapped to attributes in the IdP as well as claims from Microsoft that are being dropped due to lack of a transcoding rule. But if I understand this stuff correctly, acr is kind of a special beast. I'd really like to see the low-level decoded JSON tokens if I can.

Thanks,
Keith
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=W0TvxRP3jJaUYr4R9GgCx7vuZbRvoqaP9pfcs-4oXNWq4rBmxGaUTSlIZe6ARPei&s=FCmAgxxKalW_2aqqpkD9beHCU9tstB2wrNDcDWXFFDw&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260305/2df1656a/attachment.htm>