...
Note : the rewrite rule should probably end with a the [L] flag.
Activation
Support for dynamic discovery is enabled by enabling a profile configuration bean called (or inherited from) "OIDC.Configuration". The clients (RPs) cannot be authenticated during the discovery sequence, so the only way to enable this profile is via the shibboleth.UnverifiedRelyingParty bean (see RelyingPartyConfiguration) since the RP by definition isn't verified.
...