<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Keith,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 20 Aug 2020, at 20.56, Wessel, Keith <<a href="mailto:kwessel@illinois.edu" class="">kwessel@illinois.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Just one question from your example: am I correct that, to make this work, we have to apply both step 1 (relying party override) and step 2 (client metadata change)? I assume so but just wanted to make sure that both steps were needed rather than one of the other.</span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div></div></div></blockquote><br class=""></div><div>You can configure the supported token endpoint authentication methods for the default OIDC.SSO profile with the “idp.oidc.tokenEndpointAuthMethods” property. As its default value (it's a list) does not contain “none” type, the RPs relying on the default profile configuration cannot have “token_endpoint_auth_method" claim set to “none”. That value would be ignored if it was set.</div><div><br class=""></div><div>You could globally enable the “none” type via property, but I believe it’s clearer to use the RelyingPartyOverrides -element instead and enable it only for the RPs that really require it. You probably need to use RelyingPartyOverrides anyway in order to force PKCE (p:forcePKCE) for them.</div><div><br class=""></div><div>BR,</div><div>Henri.</div></body></html>