<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Trailing whitespace in idc.properties was the culprit.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
TYVM.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="ms-outlook-mobile-signature" style="color: inherit; background-color: inherit;">
<div>-- </div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Raymond Walker</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Software Systems Engineer Lead</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Enterprise Identity & Platform Engineering</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ITS Northern Arizona University</div>
</div>
<div id="mail-editor-reference-message-container" style="color: inherit; background-color: inherit;">
<div class="ms-outlook-mobile-reference-message skipProofing">
<meta name="Generator" content="Microsoft Exchange Server" style="color: inherit; background-color: inherit;">
</div>
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor;">
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Henri Mikkonen <henri.mikkonen@nimbleidm.com><br>
<b>Date: </b>Thursday, July 23, 2026 at 2:02 AM<br>
<b>To: </b>users@shibboleth.net <users@shibboleth.net><br>
<b>Subject: </b>Re: OIDC OP dynamic discovery<br>
<br>
</div>
</div>
<div class="PlainText" style="font-size: 11pt;">Hi Raymond,<br>
<br>
Double check that the value of value of 'idp.oidc.issuer' in<br>
conf/oidc.properties matches the 'issuer' value in<br>
static/openid-configuration.json.<br>
<br>
The match must be exact: same case, no trailing white-spaces, etc.<br>
<br>
BR,<br>
Henri.<br>
<br>
On 23.7.2026 0.09, Raymond Drew Walker via users wrote:<br>
> When attempting to configure IDP 5.2.3 with the OP (oidc) plugin:<br>
> Plugin: net.shibboleth.oidc.common Current Version: 3.3.0<br>
> Plugin: net.shibboleth.idp.plugin.oidc.op Current Version: 4.3.1<br>
> Plugin: net.shibboleth.idp.plugin.oidc.config Current Version: 3.0.1<br>
><br>
> I believe I've followed all the documentation as appropriate but am<br>
> getting stumped on debugging this one…<br>
><br>
> *<br>
> redirect is working as expected via:<br>
> RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/<br>
> configuration [L]<br>
> *<br>
> Using the basic static/openid-configuration.json (with our OP issuer<br>
> replacing {{ service_name }} )<br>
> * can hit idp/profile/oidc/keyset so I believe OP metadata is not a<br>
> problem<br>
> *<br>
> dynamic configured discovery ie. <ref bean="OIDC.Configuration" /><br>
> in shibboleth.UnverifiedRelyingParty<br>
><br>
><br>
> I'm running into an interesting error when attempting to resolve the<br>
> discovery url ".well-known/openid-configuration" :<br>
> {<br>
> "error_description": "InputOutputError",<br>
> "error": "server_error"<br>
> }<br>
><br>
> logs appear as:<br>
> 2026-07-22 14:03:51,581 - 192.168.65.3 - DEBUG<br>
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext:68] - Profile Action InitializeOutboundResponseMessageContext: Initialized outbound message context<br>
> 2026-07-22 14:03:51,582 - 192.168.65.3 - DEBUG<br>
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext:77] - Profile Action InitializeUnverifiedRelyingPartyContext: new RelyingPartyContext successfully created and attached<br>
> 2026-07-22 14:03:51,586 - 192.168.65.3 - WARN<br>
> [net.shibboleth.idp.plugin.oidc.op.metadata.impl.FilesystemProviderMetadataResolver:146] - Could not find any clients with the given criteria<br>
> 2026-07-22 14:03:51,586 - 192.168.65.3 - ERROR<br>
> [net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundDiscoveryResponse:86] - Profile Action FormOutboundDiscoveryResponse: Could not resolve provider metadata<br>
> 2026-07-22 14:03:51,588 - 192.168.65.3 - WARN<br>
> [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event<br>
> occurred while processing the request: InputOutputError<br>
> 2026-07-22 14:03:51,592 - 192.168.65.3 - INFO [Shibboleth-<br>
> Audit.OIDC.Configuration:333] - 192.168.65.3||<br>
> 2026-07-22T21:03:51.592613210Z|||http://shibboleth.net/ns/profiles/oidc/<br>
> configuration|||||||||||||JSONErrorResponse|||||||Mozilla/5.0<br>
> (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like<br>
> Gecko) Chrome/150.0.0.0 Safari/537.36|<br>
><br>
> Unsure how to debug at this point, I’ve already been down a few AI led<br>
> rabbit-holes after exhausting my own resources...<br>
><br>
> --<br>
> Raymond Walker<br>
> Software Systems Engineer Lead<br>
> Enterprise Identity & Platform Engineering<br>
> ITS Northern Arizona University<br>
><br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" data-outlook-id="718684bb-7aa4-4a54-9486-dc466d455b8f">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</div>
</body>
</html>