<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Hi Henry,</p>
<p><br>
</p>
<p><font size="2"><span style="font-size:10pt">> If you enable full logging to protocol messages in logback.xml:<br>
<br>
> <logger name="PROTOCOL_MESSAGE.OAUTH2" level="ALL" /><br>
<br>
> Then you'll get full information of the request message contents from <br>
> client to the token endpoint. There you can see the value for <br>
> Authorization-header which you can decode yourself to check whether it <br>
> contains the same secret value that you've configured in the metadata.</span></font><br>
</p>
<p><br>
</p>
<p>many thanks for this useful information. There was a special character in the client secret which was causing issues. After replacing it the client authenticates successfully. I wish you happy holidays!</p>
<p><br>
</p>
<p>Best,<br>
</p>
<p><br>
</p>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p><span lang="en-US"></span></p>
<div style="margin:0"><font face="Calibri,sans-serif" size="2" style="font-family:Calibri,sans-serif,serif,"EmojiFont""><span style="font-size:11pt"><font size="2"><span style="font-size:8.5pt"><b></b>David Stava<b></b></span></font></span></font></div>
<br>
<div style="margin:0"><font face="Calibri,sans-serif" size="2" style="font-family:Calibri,sans-serif,serif,"EmojiFont""><span style="font-size:11pt"><font size="2"><span style="font-size:8.5pt"><br>
</span></font></span></font></div>
<br>
<p></p>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Henri Mikkonen <henri.mikkonen@nimbleidm.com><br>
<b>Sent:</b> Thursday, December 19, 2024 2:00:42 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> [ISTA-Suspicious] Re: OIDC plugin credential validator failed</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">[EXTERNAL EMAIL - USE CAUTION when clicking links or attachments]
<br>
<br>
<br>
Hi David,<br>
<br>
On 19.12.2024 14.46, David Stava via users wrote:<br>
> I'm trying to setup the first RP and get an error that client <br>
> authentication failed.<br>
> <br>
> 2024-12-19 13:23:41,224 - INFO <br>
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.OIDCClientInfoCredentialValidator:167] - Credential Validator oauth2-clientinfo: Login by 'rp-test' failed<br>
> 2024-12-19 13:23:41,225 - DEBUG <br>
> [net.shibboleth.idp.plugin.oidc.op.authn.impl.JWTCredentialValidator:168] - Credential Validator oauth2-jwt: OAuth client authentication for 'rp-test' of unsupported type: client_secret_basic<br>
<br>
Those are the expected log-lines if the client secret is wrong in the <br>
incoming request.<br>
<br>
The second log-line is not really an error: it's a debug-line that <br>
simply tells that JWTCredentialValidator isn't going to proceed as the <br>
client authentication was client_secret_basic.<br>
<br>
If you enable full logging to protocol messages in logback.xml:<br>
<br>
<logger name="PROTOCOL_MESSAGE.OAUTH2" level="ALL" /><br>
<br>
Then you'll get full information of the request message contents from <br>
client to the token endpoint. There you can see the value for <br>
Authorization-header which you can decode yourself to check whether it <br>
contains the same secret value that you've configured in the metadata.<br>
<br>
BR,<br>
Henri.<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
<br>
</div>
</span></font>
</body>
</html>