<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
When attempting to configure IDP 5.2.3 with the OP (oidc) plugin:<br>
Plugin: net.shibboleth.oidc.common Current Version: 3.3.0<br>
Plugin: net.shibboleth.idp.plugin.oidc.op Current Version: 4.3.1<br>
Plugin: net.shibboleth.idp.plugin.oidc.config Current Version: 3.0.1<br>
<br>
I believe I've followed all the documentation as appropriate but am getting stumped on debugging this one…</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
<br>
</div>
<ul style="text-align: left; margin: 4px 0px 4px 24px; padding-left: 0px; list-style-position: outside;">
<li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29); margin: 2px 0px;">
<div role="presentation"><span style="text-transform: none;">redirect is working as expected via:</span></div>
<div role="presentation" style="direction: ltr;">RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/configuration [L]</div>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29); margin: 2px 0px;">
<div role="presentation" style="direction: ltr;">Using the basic static/openid-configuration.json (with our OP issuer replacing {{ service_name }} )</div>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29); margin: 2px 0px;">
<span style="text-transform: none;" role="presentation">can hit idp/profile/oidc/keyset so I believe OP metadata is not a problem</span></li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29); margin: 2px 0px;">
<div role="presentation"><span style="text-transform: none;">dynamic configured discovery ie.
</span><ref bean="OIDC.Configuration" /> in shibboleth.UnverifiedRelyingParty</div>
</li></ul>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
I'm running into an interesting error when attempting to resolve the discovery url ".well-known/openid-configuration" :</div>
<div style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; margin: 4px 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
{</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
"error_description": "InputOutputError",</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
"error": "server_error"</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
}</div>
<div style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; margin: 4px 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
<br>
</div>
<div style="text-align: left; text-indent: 0px; text-transform: none; margin: 4px 0px; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(29, 28, 29);">
logs appear as:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,581 - 192.168.65.3 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext:68] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,582 - 192.168.65.3 - DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:77] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,586 - 192.168.65.3 - WARN [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,586 - 192.168.65.3 - ERROR [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:86] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,588 - 192.168.65.3 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InputOutputError</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-07-22 14:03:51,592 - 192.168.65.3 - INFO [Shibboleth-Audit.OIDC.Configuration:333] - 192.168.65.3||2026-07-22T21:03:51.592613210Z|||http://shibboleth.net/ns/profiles/oidc/configuration|||||||||||||JSONErrorResponse|||||||Mozilla/5.0 (Macintosh; Intel Mac
OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36|</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Unsure how to debug at this point, I’ve already been down a few AI led rabbit-holes after exhausting my own resources...</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="ms-outlook-mobile-signature" style="color: inherit; background-color: inherit;">
<div>-- </div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Raymond Walker</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Software Systems Engineer Lead</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Enterprise Identity & Platform Engineering</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ITS Northern Arizona University</div>
</div>
</body>
</html>