Provider authentication function ignores the client type and uses client_secret for public providers

[bcollet]

Describe the bug

The authenticate_povider function, defined in authentik.providers.oauth2.utils validates the client_secret against the configured value for the provider, even for a public provider.

The client_secret value for a public provider is hidden from the UI but it is still set (and usually left to the default autogenerated value).

To Reproduce
Steps to reproduce the behaviour:

1. Retrieve a valid access or refresh token for a public provider.
2. Retrieve the client_id for that public provider.
3. Run the following curl command:

curl -s -u '<client_id retrieved on step 2>:' \
  -X POST \
  -d "token=<token retrieved on step 1>" \
  https://authentik.io/application/o/introspect/

4. See that it fails.
5. Go to Providers, edit the public provider.
6. Select Client type -> Confidential, copy the Client Secret value, hit Cancel (do not save the change, leave it configured as a Public provider).
7. Run the following curl command:

curl -s -u '<client_id retrieved on step 2>:<client_secret retrieved on step 5>' \
  -X POST \
  -d "token=<token retrieved on step 1>" \
  https://authentik.io/application/o/introspect/

8. See that it works.

Alternatively, one can edit the public provider, set it to confidential, blank out the Client Secret field, set it back to public and then try the curl command on step 3 and see that it now works.

Expected behavior

I expected the validation for public providers to either check that the client_secret passed through Basic auth is empty or to ignore it entirely as its done with the token endpoint.

Logs

When it fails (running step 3):

{"auth_via": "unauthenticated", "domain_url": "authenik.io", "event": "(basic) Provider for basic auth does not exist", "host": "authentik.io", "level": "debug", "logger": "authentik.providers.oauth2.utils", "pid": 42, "request_id": "14b3d13e068b438fbe14904a1c7b2381", "schema_name": "public", "timestamp": "2024-10-05T07:41:34.909792"}

Version and Deployment (please complete the following information):

• authentik version: 2024.8.3
• Deployment: docker-compose

Additional context
Add any other context about the problem here.

[authentik-automation]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[bcollet]

I still intend to implement the alternative option described in #11618 as soon as I have available bandwidth.

[authentik-automation]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.