Debugging SAML to OIDC ACR proxying

[Philip Smart]

Hi Keith,

    |   I still don't see any of the events in the logs that you described

I can’t help with the root Entra issues, but I forgot that the token decoder does have TRACE logging (not proper protocol messaging right now) of what it gets back from the Token endpoint. You could try adding a TRACE level logger for net.shibboleth.oidc.profile.decoding.impl.AccessTokenResponseDecoder, which will log the entire ‘Token Response’.

Phil


Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260312/7f4eefad/attachment.htm>