configure token_endpoint_auth_methods_supported

[karmaking]

We need to disable the none method from token_endpoint_auth_methods_supported and userinfo_signing_alg_values_supported for a client. Is there some way to configure this?

Thanks and cheers!

[vinckr]

Hey @karmaking
apologies for the late response, I am not sure if I can give you a good answer here.

The token_endpoint_auth_method parameter in the OAuth 2.0 client settings does allow you to specify the client authentication method for the token endpoint. The options include client_secret_basic, client_secret_post, private_key_jwt, and none.

If you want to disable the none method, you might be able to do so by not including it in this parameter, but this is not explicitly stated in the documentation so I am not sure.

I recommend trying it out and reporting back 🙏

[karmaking]

Hi @vinckr , thanks for your reply!

I actually doubt it can be configured this way, because TokenEndpointAuthMethodsSupported seems hard-coded in

hydra/oauth2/handler.go

Line 237 in 82208c4

TokenEndpointAuthMethodsSupported: []string{"client_secret_post", "client_secret_basic", "private_key_jwt", "none"},

Or am I missing the right place for this?