<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">The ramp up to this has been quite rough… I have been catching up on domain knowledge for the past couple of weeks and there are still so many documents I haven’t seen yet.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">My objective is to get a client credential grant workflow setup. I have a protected resource and want to authN/authZ scripts hosted on other machines access to this resource. I’ve used the SP ./metagen.sh
to create client metadata, loaded it into the idP and am trying to manually walk through the REST workflow to better understand.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The first endpoint, I assumed, is the /token like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">POST https://<idp_hostname>/idp/profile/oidc/token<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">?client_id=<resource_server><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">&grant_type=client_credentials<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">&scope=openid<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">&resource<resource_server><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Cantor, Scott via users <users@shibboleth.net><br>
<b>Date: </b>Monday, June 6, 2022 at 4:16 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Cantor, Scott <cantor.2@osu.edu><br>
<b>Subject: </b>Re: ValidateAudience: No allowed audience for client<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">NetApp Security WARNING: This is an external email. Do not click links or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
<br>
<br>
On 6/6/22, 4:12 PM, "users on behalf of Cantor, Scott via users" <users-bounces@shibboleth.net on behalf of users@shibboleth.net> wrote:<br>
<br>
> > Is there a way to, by default, add each SP on its own audience list?<br>
> It is, for OIDC.<br>
<br>
Actually, let me correct that...the SP/RP is most definitely NOT the audience in the normal OIDC flow. The OP is the audience, the only intended use of the token is to access the UserInfo endpoint, and that's the OP's endpoint. So the RP is the client, not
the audience, which is why it's not something that comes up unless you're doing "not OIDC" things or abusing OIDC in ways that we would not support.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see </span><a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw"><span style="font-size:11.0pt">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</span></a><span style="font-size:11.0pt"><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></span></p>
</div>
</div>
</body>
</html>