<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have shibboleth v5.2.1 as an OIDC proxy (with oidc rp plugin installed). The shibboleth server has no network connectivity to the upstream OIDC OP, so it has to load the OP’s metadata in static json file.
I am having trouble getting the json file loaded by conf/authn/oidc-rp-providermetadata-resolvers.xml. The json metadata file (upstream-op.json) provided by the upstream op is like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">{<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “issuer”: “<a href="https://upstream-oidc-issuer">https://upstream-oidc-issuer</a>/idp”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “authorization_endpoint”:
<a href="https://upstream-oidc-issuer/idp/profile/oidc/authorize">https://upstream-oidc-issuer/idp/profile/oidc/authorize</a>”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “response_types_supported”, [“id_token”],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “response_modes_supported”, [“form_post”],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “subject_types_supported”, [“public”],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “jwks”: {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “keys”: [<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “kty”: “RSA”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “e”: “AQAB”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “n”: “……. Op key ….”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “use”: “sig”,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> “kid”: “… kid string…”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have something like below configured in file conf/authn/oidc-rp-providermetadata-resolvers.xml, but it does not work. Any idea how I should load file upstream-op.json?<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt"><util:list id=”shibboleth.authn.oidc.ProviderMetadataResolvers”><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <ref-bean=”upstream-op-metadata”/><o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt"></util:list><o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt"><bean id=”upstream-op-metadata” parent=”shibboleth.authn.oidc.rp.StaticOIDCMetadataProviderResolver”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> P:metadataResouce=”%{idp.home}/metadata/oidc-op/upstream-op.json” /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The logs say there is no shibboleth.authn.oidc.StaticOIDCMetadataProviderResolver. What is the right tool to load the json metadata?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you very much in advance for any help.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Johnny<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>