Hi Jose,
Thanks for your suggestion, it seems worth looking into but I don't really follow how it fits it the bigger picture. We're using Gluu as the authentication heavy lifting component, our app sits behind httpd reverse proxy while a Gluu client mod_auth_openid provides our app with authentication headers. Works really well up until this OP. We don't write any particular authentication code aside from parsing the incoming openid headers so I'm not sure how oxd fits into this. Does it replace a Passport strategy? Will I create a new Passport provider using oxd giving it all the OpenID configuration for the remote OP?
I also understand it's possible to install a new strategy into oxpassport, this might also work, I could try and add the certificed OpenID Passport.js strategy.
These are the settings I used for mod_auth_openid:
```
OIDCProviderMetadataURL <openid discovery URL> (does automatically set some other parameters probably)
OIDCClientID <openid clientid>
OIDCRedirectURI <RP redirect url>
OIDCScope <scopes to include>
OIDCClientJwksUri <public jwks key url>
OIDCPublicKeyFiles <encryption public key> <signing public key>
OIDCPrivateKeyFiles <signing private key> <encryption private key>
OIDCUserInfoSignedResponseAlg RS256
OIDCUserInfoEncryptedResponseAlg RSA-OAE
```
Perhaps the encrypted userinfo endpoints could be problematic.
Gr