[External Email] Re: disable oauth2-jwt

[Cantor, Scott]

> Okay. I ensured that client_secret_basic was set, but it still
> failed.

All we can really tell you at this stage is that the secret's wrong.

I see your using the inline hash trick for it, so the only conclusion I would be able to reach is they just don't match.

The most likely reason would be the hash was corrupted accidentally, it's sensitive to things like linefeeds, easy to forget a -n parameter somewhere when piping data into a sha tool.

It is allowed to put the secret inline verbatim, so for testing you might want to just do that.

Of course, we can't prove the client is actually sending the right secret in the first place.

Logging-wise, the inference is simply "they didn't match", it wouldn't be logging anything else for that case.

-- Scott