OIDC client authentication issue

[Mak, Steven]

Try adding:

"token_endpoint_auth_method":"client_secret_post"

to your OIDC registration for the RP. Or you could set a similar setting in relying party override.

- Steve Mak

From: users <users-bounces at shibboleth.net> on behalf of Guillaume Rousse via users <users at shibboleth.net>
Date: Monday, August 10, 2026 at 9:29 AM
To: Shib Users <users at shibboleth.net>
Cc: Guillaume Rousse <guillaume.rousse at renater.fr>
Subject: OIDC client authentication issue

Hello list.

We're trying to configure OpenID authentication with a Stormshield
firewall, but it fails immediatly after discovery step:

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:140] -
OpenIDConfigurationSuccessResponse{content={...}}
2026-08-10 14:58:42 - INFO [Shibboleth-Audit.OIDC.Configuration:333] -
T:2026-08-10T12:58:42.141238445Z, b:, I:, SP:,
P:http://shibboleth.net/ns/profiles/oidc/configuration, IDP:,
bb:OpenIDConfigurationSuccessResponse, III:, u:, ac:, attr:, n:, i:, X:,
UA:snsoidc, a:10.45.50.12

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:114] -
OIDCTokenRequestDecoder{authorizationGrant=ClientCredentialsGrant{type=client_credentials},
clientAuthentication=ClientAuthentication{clientId=XXX,
method=client_secret_post}, customParameters={},
endpointURI=https://10.45.49.26/idp/profile/oidc/token}
2026-08-10 14:58:42 - WARN
[net.shibboleth.idp.plugin.oidc.op.authn.impl.ValidateClientAuthenticationType:169]
- Profile Action ValidateClientAuthenticationType: Client
'dev-app-sns-eva-0001.renater.fr' registered client_secret_basic but
attempted client_secret_post

2026-08-10 14:58:42 - DEBUG [PROTOCOL_MESSAGE.OAUTH2:140] -
TokenErrorResponse{errorObject=ErrorObject{httpStatusCode=400,
code=invalid_request, description=InvalidEvent}}
2026-08-10 14:58:42 - INFO [Shibboleth-Audit.OIDC.Token:333] -
T:2026-08-10T12:58:42.163634311Z, b:TokenRequest, I:,
SP:dev-app-sns-eva-0001.renater.fr,
P:http://shibboleth.net/ns/profiles/oauth2/token,
IDP:https://dev-idp.renater.fr, bb:TokenErrorResponse, III:, u:, ac:,
attr:, n:, i:, X:, UA:snsoidc, a:10.45.50.1

Dumping raw HTTP exchange shows a standard POST request:
POST /idp/profile/oidc/token HTTP/1.1\r\n
Host: dev-idp.renater.fr\r\n
User-Agent: snsoidc\r\
Accept: */*\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 98\r\n
\r\n
grant_type=client_credentials&client_id=XXX&client_secret=YYY

I'm confused by log message "client XXX registered client_secret_basic
but attempted client_secret_post", which seems to imply the RP says
something, but acts differently, whereas I see no evidence in exchanged
messages than the RP does anything else than trying to authenticate with
client_secret_post method.

Is the RP supposed to tell the server which method he is using, or is
the OP supposed to adapt itself to whatever method is actually used ?

Regards
--
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260810/030978b6/attachment.htm>