Start/notes.ini Parameters/DEBUG_OIDC_CONFIG

DEBUG_OIDC_CONFIG

Parameter: DEBUG_OIDC_CONFIG
Short description: Enables debug tracing from Domino 14.0 onward for the validation of OIDC provider configurations and access tokens against the providers and keys stored in idpcat.nsf. First choice for new OIDC configurations.

Profile

Parameter
DEBUG_OIDC_CONFIG
Category
Logging / Debug
Component
Server (HTTP task / OIDC configuration)
Available since
Domino 14.0
Supported versions
14.0, 14.5, 14.5.1
GUI equivalent
notes.ini only (no GUI)
Possible values
0, 1, 2, 3, 4, 5, 6 — default 0 (off)

Description

From Domino 14.0 onward, DEBUG_OIDC_CONFIG controls the level of detail of the trace output for loading, validating, and applying the OIDC provider configuration from idpcat.nsf. It logs, among other things:
  • Checking the discovery URL (.well-known/openid-configuration) and the endpoints returned by the provider
  • Mapping of Internet Sites to a provider entry
  • Resolving issuer and audience values
  • Validation of Allowed Client IDs and Alternate Audiences
  • Validation of access tokens against the providers and keys configured in the IdP catalog (v14-specific)
According to HCL, DEBUG_OIDC_CONFIG is the first switch to enable for a new OIDC configuration, since many typical setup errors show up directly on the console here:
  • wrong issuer (iss does not match the discovery document)
  • missing link of the provider document to the Internet Site
  • incorrect entry of client_id or client_secret
  • invalid redirect URI
  • missing activation of Bearer Token or OIDC Login in the Internet Site or Server document

Example configuration

DEBUG_OIDC_CONFIG=3
Dynamically on the server console:
set config DEBUG_OIDC_CONFIG=3
To turn off:
set config DEBUG_OIDC_CONFIG=0

Notes & pitfalls

  • Available only from Domino 14.0. In 12.0.2 there was no directly comparable configuration trace; similar information was distributed across DEBUG_HTTP_BEARER_AUTH, DEBUG_JWK_CACHE, and DEBUG_JWS.
  • Only takes effect if at least one OIDC provider is configured in idpcat.nsf on the server and Bearer Token or OIDC Login is active in the Internet Site or Server document.
  • Use additionally: DEBUG_HTTP_BEARER_AUTH (token validation), DEBUG_OIDC_CACHE (JWK cache), DEBUG_OIDC_CURL_APIS (HTTPS connection to the provider), DEBUG_OIDC_JSON_PARSER (JSON parsing of token contents).
  • Effect is dynamic — no HTTP or server restart needed.
  • After diagnostics are complete, reset to 0 to avoid unnecessarily loading the console.

Sources (HCL Product Documentation)