Skip to content

Add none to supported client authentication methods - #20086

Open
therepanic wants to merge 1 commit into
spring-projects:mainfrom
therepanic:gh-20083
Open

therepanic wants to merge 1 commit into
spring-projects:mainfrom
therepanic:gh-20083

Conversation

@therepanic

Copy link
Copy Markdown
Contributor

The token endpoint supports public clients through PublicClientAuthenticationProvider, but the authorization server and OIDC provider metadata did not advertise it.

Closes: gh-20083

Although Spring Authorization Server supports public client authentication, none is currently missing from the advertised supported client authentication methods.

Closes: spring-projectsgh-20083

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
@therepanic therepanic changed the title Add none to token_endpoint_auth_methods_supported Add none to supported client authentication methods Nov 12, 2026
Comment on lines +208 to +210
jsonPath("$.introspection_endpoint_auth_methods_supported[4]").value(ClientAuthenticationMethod.TLS_CLIENT_AUTH.getValue()),
jsonPath("$.introspection_endpoint_auth_methods_supported[5]").value(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.getValue()),
jsonPath("$.introspection_endpoint_auth_methods_supported[6]").value(ClientAuthenticationMethod.NONE.getValue()),

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There were no assertions for tls_client_auth and self_signed_tls_client_auth, so I added them.

@therepanic

Copy link
Copy Markdown
Contributor Author

I added none to the clientAuthenticationMethods(), so it is also advertised for the revocation and introspection endpoints, not only token endpoint.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Authorization server metadata does not list none in token_endpoint_auth_methods_supported

2 participants