token_endpoint_auth_methods_supported offers no choice in use

[M0rdent]

https://github.com/jumbojett/OpenID-Connect-PHP/blob/45aac47b525f0483dd4db3324bb1f1cab4666061/src/OpenIDConnectClient.php#L927C1-L927C9

Hi.
If "token_endpoint_auth_methods_supported" on the sso server contains, but is not limited to, "client_secret_basic", then the script on this line tries to perform authorization only by this method. Without a choice, because on line 267 he assigns "client_secret_basic" by default.
OIDC on DSM 7.2 does not skip login/password authorization, because the Application is authorized, not the user.
It would be nice to add a variable which method to use.
I forcibly disabled the basic authorization method by commenting out lines 927-931.
But it won't help when updating)

Thank you.

[ricklambrechts]

Does client_secret_basic not work?
What method do you want to use? client_secret_post?

[M0rdent]

Hi.
".well-known" gives 2 methods: basic and post.
"basic" does not pass.

[ricklambrechts]

You could call $oidc->setTokenEndpointAuthMethodsSupported(['client_secret_post']);.
Before calling $oidc->authenticate();.

This sets the auth method to client_secret_post.

[M0rdent]

good. but
if "authenticate" sees $_REQUEST['code'], it runs "requestToken($code)" (line 325).
This method on line 913 requests the available methods:
$token_endpoint_auth_methods_supported = $this->getProviderConfigValue('token_endpoint_auth_methods_supported', ['client_secret_basic'])
since there is no saved data in "providerConfig", it will be received from the SSO server. which will say that there are basic and post methods.
And on line 927, the condition "find basic" matches.
or do I misunderstand the logic?

[ricklambrechts]

This function handles that:

OpenID-Connect-PHP/src/OpenIDConnectClient.php

Lines 2053 to 2061 in 8ec206b

	public function supportsAuthMethod(string $auth_method, array $token_endpoint_auth_methods_supported): bool
	{
	# client_secret_jwt has to explicitly be enabled
	if (!in_array($auth_method, $this->token_endpoint_auth_methods_supported, true)) {
	return false;
	}
	return in_array($auth_method, $token_endpoint_auth_methods_supported, true);
	}

client_secret_basic is not in $this->token_endpoint_auth_methods_supported becasue of $oidc->setTokenEndpointAuthMethodsSupported(['client_secret_post']);. So the function returns false.

[M0rdent]

it helped me. Thanks)