<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">
Scott,</div>
<div dir="ltr" style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There is no client metadata for the OIDC services. The extent of the config is below. I have several OIDC services working but this is the first for a mobile app and the first that does not want a client secret.</div>
<div dir="ltr" style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
{</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"client_id": “FooMobileApp",</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"response_types": ["code"],</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"scope": "openid profile email offline_access",</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"redirect_uris": [“foo.mobile://oauthredirect/"],</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"token_endpoint_auth_method": "none",</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"pkce_required": true,</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"application_type": "native",</div>
<div style="text-align: left; text-indent: 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"grant_types": ["authorization_code"]</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}<br>
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div class="ms-outlook-mobile-reference-message skipProofing">
<meta name="Generator" content="Microsoft Exchange Server">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>Cantor, Scott <cantor.2@osu.edu><br>
<b>Date: </b>Wednesday, August 6, 2025 at 11:46 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Hall, Gerry <gerry.hall@emory.edu><br>
<b>Subject: </b>[External] Re: OIDC for Mobile App<br>
<br>
</div>
<div class="PlainText" style="font-size: 11pt;">If you want no secret then you need to change your client metadata, in whatever format, to reflect what client authn methods you want to allow, namely "none" I believe.<br>
<br>
-- Scott<br>
<br>
<br>
</div>
</div>
</body>
</html>