feat(jans-auth-server): we should make fallback for client's `tokenEndpointAuthMethod` configurable

[yuriyz]

Description

feat(jans-auth-server): we should make fallback for client's tokenEndpointAuthMethod configurable

Currently if tokenEndpointAuthMethod is absent AS always falls back to hardcoded client_secret_basic value.

[nynymike]

I also wonder if an admin may want to allow a client to use several mechanisms.

According to this diagram, basic and post are pretty much the same from a security perspective. Also, perhaps an admin wants to just leave it up to the client developer how much security to use.

Is it possible to enable the support of multiple authn mechanims at the token endpoint?

[yuriyz]

Currently it's not possible but I will check how easy or hard to add such support.

We should also answer the question how do we pass multiple values
https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest

token_endpoint_auth_method
OPTIONAL. Requested Client Authentication method for the Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, private_key_jwt, and none, as described in Section 9 of [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-registration-1_0.html#OpenID.Core) [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of [OAuth 2.0](https://openid.net/specs/openid-connect-registration-1_0.html#RFC6749) [RFC6749].

Since we still want to be compatible with standard Connect we can introduce additional token_endpoint_auth_methods (with s at the end which will be array of strings)

[nynymike]

Are you suggesting that we leave the current token_endpoint_auth_method as is, and offer an alternative claim with different behavior? That would be ok. This isn't a super high priority... we've been living with this as is for years. It just seemed annoying to have to change the client config when changing between basic and post.

[yuriyz]

Ok, I'm going to introduce additional_token_endpoint_auth_methods to highlight that main value is in token_endpoint_auth_method compatible with Connect and we provide ability to support more methods.

token_endpoint_auth_method vs token_endpoint_auth_methods is too confusing even in code.