<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Figured it out, let me know if I did the right thing and if it would be safe to add
this to the default profile configuration.<br>
<br>
<ref bean="OAUTH2.Token" /></span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Is what I added to the profile configuration with the id=ForceMFA and now the Globus
integration is working.</span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken" id="LPlnk564688">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2931327005/OPToken</a></span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The key phrase is listed at the top of the page:<br>
This profile configuration was introduced in V3.1 of this plugin. In older releases, it was implicitly part of the OIDC.SSO profile configuration and was not a separate feature.</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> December 21, 2023 11:39 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Darren Boss <Darren.Boss@alliancecan.ca><br>
<b>Subject:</b> Re: Problem with MFA flows for OIDC client</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[You don't often get email from cantor.2@osu.edu. Learn why this is important at
<a href="https://aka.ms/LearnAboutSenderIdentification">https://aka.ms/LearnAboutSenderIdentification</a> ]<br>
<br>
The error is somewhere in the configuration of the OAuth2 client authentication. Same layer is used so the logging and errors are similar, it's basically saying it couldn't run any configured flow for authenticating them.<br>
<br>
Out of the box the default configuration just supports the use of client metadata to identify client secrets or keys depending on the method the client used to secure the token request.<br>
<br>
The lack of logging and just direct failure suggests an unwarranted change to the defaults around authenticating clients, it's not even trying to do anything.<br>
<br>
-- Scott<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>