[External Email] Re: disable oauth2-jwt

[Cantor, Scott]

> I don't want to eliminate it. I am trying to authenticate using
> client_secret_basic or client_secret_post, but they are both
> failing, so I am trying to understand/figure out why this is
> happening.

It's not that, there should be more logging ahead of that if the secret validation isn't working.

You have to make sure the client's metadata includes the desired method(s) but other than that, it depends what you want to use to verify the secrets. The default just relies on the metadata itself or various related methods to associate secrets with clients using the metadata.

Without knowing what it's saying, I don't know at what stage the problem exists, or how you want to actually manage the secrets.

My view is/was that this is all a toy until you handle the secrets using a standard method like LDAP or Kerberos, essentially managing them as service accounts. So the code was enhanced to allow for that, but none of that is configured OOB.

> I need help and am unsure if my support account has been
> provisioned yet.

Not as of yet, but I'll assist here.

-- Scott