From 68ed2c1a750574558695ff79574bde856e57bf98 Mon Sep 17 00:00:00 2001 From: michaelryanmcneill Date: Thu, 30 Jul 2026 16:00:04 -0400 Subject: [PATCH] OCPBUGS-99757: Set oauth2 AuthStyle to AuthStyleInParams for OIDC token endpoint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The go-oidc library's Endpoint() returns an oauth2.Endpoint without setting AuthStyle, defaulting to auto-detect. Auto-detect tries AuthStyleInHeader (HTTP Basic Auth) first, which omits client_id from the POST body. Microsoft Entra ID does not support client_secret_basic and rejects this with AADSTS900144. Explicitly set AuthStyle to AuthStyleInParams so that client_id is always sent in the POST body. This is correct per RFC 6749 ยง2.3.1 for public clients and is supported by all targeted OIDC providers (Keycloak, Entra ID, ADFS, GitLab, Google, Okta, Ping Identity). Signed-off-by: michaelryanmcneill --- pkg/cli/gettoken/oidc/client.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/cli/gettoken/oidc/client.go b/pkg/cli/gettoken/oidc/client.go index 4f2b6af8d0..9f0c02d5e9 100644 --- a/pkg/cli/gettoken/oidc/client.go +++ b/pkg/cli/gettoken/oidc/client.go @@ -174,11 +174,16 @@ func NewAuthenticator(ctx context.Context, p *Provider, cacertdata string, cacer } } } + endpoint := provider.Endpoint() + if p.ClientSecret == "" { + endpoint.AuthStyle = oauth2.AuthStyleInParams + } + return &client{ httpClient: httpClient, provider: provider, oauth2Config: oauth2.Config{ - Endpoint: provider.Endpoint(), + Endpoint: endpoint, ClientID: p.ClientID, ClientSecret: p.ClientSecret, Scopes: append(p.ExtraScopes, gooidc.ScopeOpenID),