Debugging SAML to OIDC ACR proxying

[Philip Smart]

Hi Keith

| Simple question: what logging class can I turn up that would show me the ACR being sent to Microsoft in the request?

The OIDC/OAuth message encoders should show the parameters of the request if you set idp.loglevel.messages to DEBUG and find the log line with category [PROTOCOL_MESSAGE.OAUTH2]. If the OP supports the claims parameter, the ACR values should be inside the claims parameter; else, they will be inside the acr_values parameter. If you use a request object, the ACR values will be inside the request object, and you will need to decode the base64URL encoded JWT from the request parameter to find them.

| And what class would show me what's coming back?

Sadly, the same logging does not exist on the decoders, but it should [1]. However, for now, there are less elegant ways of logging the raw id_token by using a logger for the category net.shibboleth.oidc.security and setting it to DEBUG. In particular, the BaseSignedJWTTrustEngine should log the base64url encoded JWT, which you can decode.

Let me know how you get on, it is possible the RP is not behaving correctly, and we will need to fix something.

Phil

[1] https://shibboleth.atlassian.net/browse/JCOMOIDC-158




Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260306/f00b95be/attachment.htm>