<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 9. Mar 2021, at 11.21, Martin Haase <<a href="mailto:Martin.Haase@DAASI.de" class="">Martin.Haase@DAASI.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="content-type" content="text/html; charset=UTF-8" class="">
<div class=""><p class="">Hi list,</p><p class="">this is now the second time I seem to be unable to set the OIDC
issuer for the IdP. This is an upgraded IdPv4, and GEANT OIDC
plugin installed along
<a class="moz-txt-link-freetext" href="https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive">https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive</a></p><p class="">Although I have set the issuer in idp-oidc.properties...</p><p class="">idp.oidc.issuer= <a class="moz-txt-link-freetext" href="https://portal-dev.example.prj/idp">https://portal-dev.example.prj/idp</a><br class="">
</p><p class="">...the OIDC ID token seems to contain the entityID instead:</p><p class="">[Tue Mar 09 09:08:42.616020 2021] [auth_openidc:error] [pid
18630] [client 10.0.8.7:44184] oidc_proto_validate_jwt: requested
issuer (<a class="moz-txt-link-freetext" href="https://portal-dev.example.prj/idp">https://portal-dev.example.prj/idp</a>) does not match
received "iss" value in id_token
(<a class="moz-txt-link-freetext" href="https://portal-dev.example.prj/idp">https://portal-dev.example.prj/idp</a><b class="">/</b><b class="">shibboleth</b>),
referer: <a class="moz-txt-link-freetext" href="https://ubuntu1804sp.daasi.test/dummy-oidc">https://ubuntu1804sp.daasi.test/dummy-oidc</a><br class="">
</p><p class="">Any idea why this could happen, and how to fix it? <br class="">
</p></div></div></blockquote></div><div><br class=""></div><div>In conf/relying-party.xml, make sure that you have defined 'p:responderIdLookupStrategy-ref=“profileResponderIdLookupFunction”’ for the shibboleth.* beans that contain OIDC profile configurations.</div><div><br class=""></div><div>BR,</div><div>Henri.</div></body></html>