How to set OpenIdConnect Client Authentication Method (from a config as a parameter) in C# using Microsoft.AspNetCore.Authentication?

Viewed 61

Given an OIDC implementation supporting the major id providers like Google, Okta, Azure, OneLogin etc. but now I run into a problem. A client of ours wants to use their own custom IDP, which only supports client_secret_basic as a Client Authentication method as their IDP says in their meta json:

"token_endpoint_auth_methods_supported": [
"client_secret_basic"
],

As I learned, OIDC standard defines the followings: "client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt","none"

But seemingly, we "do not support" client_secret_basic as they got this error:

 Message contains error: 'invalid_client', error_description: 'client authentication failed', error_uri: 'error_uri is null'.

which I learned to indicate a problem with client authentication (method). Also, when I tried to switch the Authentication Method setting for OneLogin IDP in our dev environment as you see here

enter image description here

I got the same error message as our partner.

When browsing options for setting up AuthenticationBuilder I found something called AuthenticationMethod:

// ...
            foreach (var idp in idProviders)
            {
                builder.AddOpenIdConnect(idp.Name, idp.DisplayName, options =>
                  {
                      mapper.Map(idp.Options, options);
                      options.ResponseType = OpenIdConnectResponseType.Code;
                      options.ResponseMode = OpenIdConnectResponseMode.Query;
                      options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet; // test line added ("hardcoded") by me
// ...

It is an enum:

public enum OpenIdConnectRedirectBehavior
{
    RedirectGet = 0,
    FormPost = 1
}

Its name AuthenticationMethod seems to be similar, albeit I don't think it's the correct option as

  1. it doesn't solve the problem
  2. it has only 2 options
  3. the values of enum don't match exactly the names in the OIDC standard (like client_secret_basic)
  4. its default already RedirectGet: public OpenIdConnectRedirectBehavior AuthenticationMethod { get; set; } = OpenIdConnectRedirectBehavior.RedirectGet; whereas OneLogin works with POST but not with GET.

So, how can I change the client authentication method (and still keep supporting all standard IDPs - hence the config parameter)? Thank you!

1 Answers
Related