OIDC client authentication issue

[Guillaume Rousse]

Hello list.

We're trying to configure OpenID authentication with a Stormshield 
firewall, but it fails immediatly after discovery step:

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:140] -
OpenIDConfigurationSuccessResponse{content={...}}
2026-08-10 14:58:42 - INFO [Shibboleth-Audit.OIDC.Configuration:333] - 
T:2026-08-10T12:58:42.141238445Z, b:, I:, SP:, 
P:http://shibboleth.net/ns/profiles/oidc/configuration, IDP:, 
bb:OpenIDConfigurationSuccessResponse, III:, u:, ac:, attr:, n:, i:, X:, 
UA:snsoidc, a:10.45.50.12

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:114] -
OIDCTokenRequestDecoder{authorizationGrant=ClientCredentialsGrant{type=client_credentials}, 
clientAuthentication=ClientAuthentication{clientId=XXX, 
method=client_secret_post}, customParameters={}, 
endpointURI=https://10.45.49.26/idp/profile/oidc/token}
2026-08-10 14:58:42 - WARN 
[net.shibboleth.idp.plugin.oidc.op.authn.impl.ValidateClientAuthenticationType:169] 
- Profile Action ValidateClientAuthenticationType: Client 
'dev-app-sns-eva-0001.renater.fr' registered client_secret_basic but 
attempted client_secret_post

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:140] -
TokenErrorResponse{errorObject=ErrorObject{httpStatusCode=400, 
code=invalid_request, description=InvalidEvent}}
2026-08-10 14:58:42 - INFO [Shibboleth-Audit.OIDC.Token:333] - 
T:2026-08-10T12:58:42.163634311Z, b:TokenRequest, I:, 
SP:dev-app-sns-eva-0001.renater.fr, 
P:http://shibboleth.net/ns/profiles/oauth2/token, 
IDP:https://dev-idp.renater.fr, bb:TokenErrorResponse, III:, u:, ac:, 
attr:, n:, i:, X:, UA:snsoidc, a:10.45.50.1

Dumping raw HTTP exchange shows a standard POST request:
POST /idp/profile/oidc/token HTTP/1.1\r\n
Host: dev-idp.renater.fr\r\n
User-Agent: snsoidc\r\
Accept: */*\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 98\r\n
\r\n
grant_type=client_credentials&client_id=XXX&client_secret=YYY

I'm confused by log message "client XXX registered client_secret_basic 
but attempted client_secret_post", which seems to imply the RP says 
something, but acts differently, whereas I see no evidence in exchanged 
messages than the RP does anything else than trying to authenticate with 
client_secret_post method.

Is the RP supposed to tell the server which method he is using, or is 
the OP supposed to adapt itself to whatever method is actually used ?

Regards
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4330 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20260810/c747649d/attachment.p7s>