Support for configuring the desired Client Authentication Method for the token endpoint for the OIDC Provider

Signed-off-by: Karthik Prabhu K <karthik.prabhu.k@dell.com>

plugins/auth-backend/src/providers/oidc/provider.test.ts

@@ -53,6 +53,7 @@ const clientMetadata: Options = {
   clientId: 'testclientid',
   clientSecret: 'testclientsecret',
   metadataUrl: 'https://oidc.test/.well-known/openid-configuration',
+  tokenEndpointAuthMethod: 'none',
   tokenSignedResponseAlg: 'none',
 };
 

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -17,6 +17,7 @@
 import express from 'express';
 import {
   Client,
+  ClientAuthMethod,
   Issuer,
   Strategy as OidcStrategy,
   TokenSet,
@@ -72,6 +73,7 @@ export type Options = OAuthProviderOptions & {
   metadataUrl: string;
   scope?: string;
   prompt?: string;
+  tokenEndpointAuthMethod?: ClientAuthMethod;
   tokenSignedResponseAlg?: string;
   signInResolver?: SignInResolver<OidcAuthResult>;
   authHandler: AuthHandler<OidcAuthResult>;
@@ -144,6 +146,8 @@ export class OidcAuthProvider implements OAuthHandlers {
       client_secret: options.clientSecret,
       redirect_uris: [options.callbackUrl],
       response_types: ['code'],
+      token_endpoint_auth_method:
+        options.tokenEndpointAuthMethod || 'client_secret_basic',
       id_token_signed_response_alg: options.tokenSignedResponseAlg || 'RS256',
       scope: options.scope || '',
     });
@@ -232,6 +236,9 @@ export const oidc = createAuthProviderIntegration({
           customCallbackUrl ||
           `${globalConfig.baseUrl}/${providerId}/handler/frame`;
         const metadataUrl = envConfig.getString('metadataUrl');
+        const tokenEndpointAuthMethod = envConfig.getOptional<ClientAuthMethod>(
+          'tokenEndpointAuthMethod',
+        );
         const tokenSignedResponseAlg = envConfig.getOptionalString(
           'tokenSignedResponseAlg',
         );
@@ -252,6 +259,7 @@ export const oidc = createAuthProviderIntegration({
           clientId,
           clientSecret,
           callbackUrl,
+          tokenEndpointAuthMethod,
           tokenSignedResponseAlg,
           metadataUrl,
           scope,