Given an OIDC implementation supporting the major id providers like Google, Okta, Azure, OneLogin etc. but now I run into a problem. A client of ours wants to use their own custom IDP, which only supports client_secret_basic as a Client Authentication method as their IDP says in their meta json:
"token_endpoint_auth_methods_supported": [
"client_secret_basic"
],
As I learned, OIDC standard defines the followings: "client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"
But seemingly, we "do not support" client_secret_basic as they got this error:
Message contains error: 'invalid_client', error_description: 'client authentication failed', error_uri: 'error_uri is null'.
which I learned to indicate a problem with client authentication (method). Also, when I tried to switch the Authentication Method setting for OneLogin IDP in our dev environment as you see here
I got the same error message as our partner.
When browsing options for setting up AuthenticationBuilder I found something called AuthenticationMethod:
// ...
foreach (var idp in idProviders)
{
builder.AddOpenIdConnect(idp.Name, idp.DisplayName, options =>
{
mapper.Map(idp.Options, options);
options.ResponseType = OpenIdConnectResponseType.Code;
options.ResponseMode = OpenIdConnectResponseMode.Query;
options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet; // test line added ("hardcoded") by me
// ...
It is an enum:
public enum OpenIdConnectRedirectBehavior
{
RedirectGet = 0,
FormPost = 1
}
Its name AuthenticationMethod seems to be similar, albeit I don't think it's the correct option as
- it doesn't solve the problem
- it has only 2 options
- the values of enum don't match exactly the names in the OIDC standard (like
client_secret_basic) - its default already RedirectGet:
public OpenIdConnectRedirectBehavior AuthenticationMethod { get; set; } = OpenIdConnectRedirectBehavior.RedirectGet;
whereas OneLogin works with
POSTbut not withGET.
So, how can I change the client authentication method (and still keep supporting all standard IDPs - hence the config parameter)? Thank you!
