Support multiple Endpoint Auth Methods

[coryhardman]

I have a use case where some clients want to use client_secret_basic and others want to use client_secret_post. I do not control theses clients so I can't mandate one or the other. From my research these should be equivalently secure, so I would like to simply support both at the same time for every client rather than have the clients specify it at setup time.

This does not appear to be possible as the field in the database is limited to 25 chars. Am I missing an option to turn on support for both?

[aeneasr]

This is unfortunately not possible due to the OpenID Connect specification, sorry!

[NLelekova]

Hi @aeneasr!

I also would be really interested in this feature, and I could even suggest the respective changes (made by my team) via a pull request at some point, but now I'm very curious where exactly does it say in the OpenID Connect specification that a client can't have both authentication methods configured... Could you please give me a hint?

I'm sorry to bother you with this question. Google-ing didn't work for me🙈