<div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:monospace,monospace">Hello -</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">I believe I found the problem, but I'm unsure where / how to resolve it. I am using the PHP JumbojettOpenIDConnectClient client to test and have set the token_endpoint as listed in our well-known services; however, when passed and decoded by Shibboleth, it resolves to the server non-routable address, as shown below in the endpointURL. The redirectionURI is not affected by whatever is occurring.</div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">PHP var_dump excerpt:</div><div class="gmail_default" style="font-family:monospace,monospace">["token_endpoint"]=> string(56) "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token</a>" }<br><br>idp-process.log excerpt:<br>DEBUG [PROTOCOL_MESSAGE.OAUTH2:114] - <br>OIDCTokenRequestDecoder{authorizationGrant=AuthorizationCodeGrant{authorizationCode=ZZZZ,<br>redirectionURI=<a href="https://idp-dev.cc.binghamton.edu/openid-client/index.php" target="_blank">https://idp-dev.cc.binghamton.edu/openid-client/index.php</a>, type=authorization_code},<br>clientAuthentication=ClientAuthentication{clientId=<a href="https://casidp1-dev.cc.binghamton.edu" target="_blank">https://casidp1-dev.cc.binghamton.edu</a>, method=client_secret_basic},<br>customParameters={}, endpointURI=<a href="https://172.31.56.111/idp/profile/oidc/token" target="_blank">https://172.31.56.111/idp/profile/oidc/token</a>}<br><br>Well-known service definitions:<br>  "issuer": "<a href="https://idp-dev.cc.binghamton.edu" target="_blank">https://idp-dev.cc.binghamton.edu</a>",<br>  "authorization_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/authorize" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/authorize</a>",<br>  "registration_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/register" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/register</a>",<br>  "token_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/token</a>",<br>  "userinfo_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/userinfo" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/userinfo</a>",<br>  "introspection_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/introspection" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/introspection</a>",<br>  "revocation_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/revocation" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oauth2/revocation</a>",<br>  "jwks_uri": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/keyset" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/keyset</a>",<br>  "end_session_endpoint": "<a href="https://idp-dev.cc.binghamton.edu/idp/profile/oidc/end-session" target="_blank">https://idp-dev.cc.binghamton.edu/idp/profile/oidc/end-session</a>",<br></div><div class="gmail_default" style="font-family:monospace,monospace"><br></div><div class="gmail_default" style="font-family:monospace,monospace">-Jeff</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 19, 2024 at 3:25 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The bulk of the docs on client authentication as handled by the expected flow is in <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2929033287/OAuth2ClientAuthnConfiguration" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2929033287/OAuth2ClientAuthnConfiguration</a><br>
<br>
It assumes you know what you want to do though, in very precise technical fashion, like "I want to hash secrets and stuff them into metadata fles for testing" or "I want to use service accounts and LDAP to authenticate clients, and then use an attribute in LDAP to derive the actual client_id for the OAuth layer".<br>
<br>
-- Scott<br>
<br>
<br>
</blockquote></div>