Add Token authentication config to OpenID Connect configuration

[robotdan]

Add Token authentication config to OpenID Connect configuration

Description

Currently we always use the Authorization header when calling the Token endpoint which is the client_secret_basic method. However, we also add the client_id to the request body which is technically client_secret_post even though we aren't passing the client_secret in the body.

Some IdPs don't like this and will error. Here is an example from Okta

  {
    "error": "invalid_request",
    "error_description": "Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client_assertion in the post body."
  }

So as we have in FusionAuth, we need to add a configuration option to select which authentication method works with your IdP and then choose one or the other based upon this configuration.

Related

• Review authentication methods for the Token endpoint FusionAuth/fusionauth-issues#1595

[asharafzwift]

Hello, do you guys know when this will be resolved?