Moving an OIDC client to PKCE

[Henri Mikkonen]

Hi Keith,

On 13.2.2025 19.59, Wessel, Keith via users wrote:
> When we first went down this road of PKCE with Shibboleth a few years 
> ago, Henri said to enforce PKCE for a client, I would need to set 
> tokenEndpointAuthMethods to none and forcePKCE to true, both best done 
> with relying party overrides. As a transition, is there a way to allow a 
> given client to use standard token-based auth _/or/_ PKCE? The idea 
> would be to allow both methods, let the app developer push out a new 
> version of the app that switches to PKCE, then after a sufficient amount 
> of time for users to update to the new app version, begin forcing PKCE.

It sounds like you're combining two individual things together: (1) 
public clients (that are not able to authenticate to the token endpoint, 
thus tokenEndpointAuthMethod being "none") and (2) PKCE. It's fairly 
common due the fact that PKCE was originally designed to protect the 
code flow in public mobile or single page apps, but it's actually 
nowadays recommended for confidential clients too [1]. That page also 
highlights that PKCE is *not* a form of client authentication.

Anyway, if I read you correctly, your question can be split into these 
two questions:

1. Can single client be configured with more than one token endpoint 
authentication methods? (In your case you want to add "none" in addition 
to the current one).

- Answer is no at the moment: our RP metadata bases on the "schema" 
defined by the OIDC dynamic client registration [2] and it allows only 
one value for token_endpoint_auth_method.

2. If the answer for the previous was yes, could one enforce PKCE only 
to the ones using "none" type?

- With some scripting, yes. Instead of simply using the true/false flag 
for the 'forcePKCE' relying party option, one could exploit 
'forcePKCEPredicate' to wire a custom predicate for enforcing it 
whenever "none" client authentication was used. Some code/scripting 
would be needed though.

Let me know if I understood your question correctly?

BR,
Henri.

[1] https://oauth.net/2/pkce/

[2] 
https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata