invalid_client error with wrong method

[vahem2lu]

I'm using OAUTH2 provider and getting a response with error:
'error' => 'invalid_client',
'error_description' => 'Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method \'client_secret_basic\', but method \'client_secret_post\' was requested. You must configure the OAuth 2.0 client\'s \'token_endpoint_auth_method\' value to accept \'client_secret_post\'.',
How can one change authentication method?

[pradtke]

Hi @vahem2lu , I think you can set "accessTokenMethod" => "GET and it will use GET instead of POST. Can you try that and let me know if it works, and I can add it as an example in the documentation.

[vahem2lu]

As my provider is based on OpenID Connect, I've made another ticket (#51) which is not working at all due to wrong scope. Although it should work with OAUTH2.0 as well.

So when I'm configuring this as authoauth2:OAuth2 then at least I can get somewhere.

Now, changed accessTokenMethod to GET and I'm getting error (as GET is not allowed, I guess).
Caused by: UnexpectedValueException: Invalid response received from Authorization Server. Expected JSON.
But I'm pretty sure it should be correct JSON what this server is replying.

But If I try with curl

curl -X POST -d "code=CODE_HERE" \
    -d "client_secret=SECRET_HERE" \
    -d "client_id=CLIENT_ID_HERE" \
    -d "redirect_uri=https://mySSPURL/simplesaml/module.php/authoauth2/linkback.php" \
    -d 'grant_type=authorization_code' \
   https://MyOIDCprovider/oidc/token

{"error":"invalid_client","error_description":"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The OAuth 2.0 Client supports client authentication method 'client_secret_basic', but method 'client_secret_post' was requested. You must configure the OAuth 2.0 client's 'token_endpoint_auth_method' value to accept 'client_secret_post'."}%

And if I try with -X GET (as it should occur when replacing accessTokenMethod) then I get Method not allowed (which indeed is not a valid JSON. 🤣

[pradtke]

What software is the OIDC OP running? It sounds like you need to either change the client's configuration at the OP to allow for client_secret_post or ask the OP to support client_secret_basic.

[vahem2lu]

It's based on Apereo CAS, but it's custom modified. Based on documentation it supports only header Authorization: Basic, not inside curl data POST.
Can I configure this module to authenticate with header Authorzation: Basic <token> instead of POST data?

[pradtke]

I'm not sure. You probably need to edit the OAuth2 authsource and add a way to pass custom collaborators in. Then you would send a $collaborator['optionProvider'] = new HttpBasicAuthOptionProvider() or you can write your own provider to set the requests the way you need.