Invalid client or client credentials

[gitkent]

Hi team, we got the following config integrated with PING which is working fine:

LogLevel auth_openidc:debug
LoadModule auth_openidc_module /usr/lib/apache2/modules/mod_auth_openidc.so

OIDCProviderMetadataURL https://my-provider/.well-known/openid-configuration
OIDCProviderTokenEndpointParams client_secret=${CLIENT_SECRET}
OIDCClientID my_client_id
#OIDCClientSecret "exec:/usr/bin/echo $CLIENT_SECRET"

OIDCPKCEMethod none
OIDCXForwardedHeaders X-Forwarded-Port
OIDCRedirectURI https://my-url/oauth/callback
OIDCCryptoPassphrase "exec:/usr/bin/echo $CRYPTO_PASSPHRASE"

<Location />
  AuthType openid-connect
  Require valid-user
  LogLevel debug
</Location>

However, we are wondering why when we set OIDCClientSecret it was not working and throwing the following error:

{dt.trace_id=***, dt.span_id=***, dt.trace.sampled=true} Handling normal exception condition in token endpoint: org.sourceid.oauth20.handlers.AccessTokenRequestException: invalida_client: Invalida client or client credentials.

and we have to workaround with OIDCProviderTokenEndpointParams? Without this, we noticed from the PING's log that the call to token endpoint is not passing client_secret.

Can anyone please assist?

[zandbelt]

https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.16.3/auth_openidc.conf#L102-L107

[gitkent]

Setting OIDCProviderTokenEndpointAuth to client_secret_post works. Thanks @zandbelt