Should client_id/secret be mandatory?

[pedro]

Hey folks!

I maintain the omniauth-heroku strategy, and some of our users keep running into issues when they don't provide a proper client id and secret, which can be hard to debug because the oauth strategy will just attempt to redirect anyways.

I've added a validation to our strategy, but now wondering if this shouldn't be validated here.

Is there a use case for omniauth-oauth2 in which you don't provide a client id and secret? If not I can definitely open a pull, any feedback on how that was handled is welcome.

Thanks,