1
Token exchange using client_secret_post as Token Endpoint Authentication Method
Source: dani-garcia/vaultwarden#7255 · opened by @Alexandre-BARBIER
Hello,
There are different methods usable for OIDC for the Token Exchange
Right now, as the method isn't specified, it defaults to using client_secret_basic (credentials sent through the the HTTP Authorization header).
While client_secret_basic is the OIDC specification default, many enterprise-grade Identity Providers (such as Ping Identity) use client_secret_post by default.
This create issues for the use of VaultWarden in my company context.
There are different methods usable for OIDC for the Token Exchange
Right now, as the method isn't specified, it defaults to using client_secret_basic (credentials sent through the the HTTP Authorization header).
While client_secret_basic is the OIDC specification default, many enterprise-grade Identity Providers (such as Ping Identity) use client_secret_post by default.
This create issues for the use of VaultWarden in my company context.
No pledges yet. Be the first to back this.
Comments
Similar requests
Issue: WebSocket Token in URI
1 vote · 0 comments
Missing authentication for the /icons/ endpoint
1 vote · 0 comments
Feature Request: MCP Wallet/Server Integration for AI Agent Authentication
2 votes · 0 comments
Error decoding JWT
1 vote · 0 comments
Feature Request: Map OIDC group claims to Collections (post-authentication)
9 votes · 0 comments
No comments yet.