Add basic auth support for OpenId token endpoint (client_secret_basic)

[agavrilov76]

Target Jetty version(s)
9, 10, 11

Enhancement Description

Some open ID providers use only Basic Authentication (client_secret_basic) to protect token endpoint(s) as described in https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication. The Jetty's open id module supports only client_secret_post authentication scheme, that is the client secret is posted as a form parameter. It would good to add support for basic auth, or allow developers to easily override that.

Currently, it is possible to register a custom http client with a basic auth module but it is not possible to remove unexpected client_secret parameter.

[lachlan-roberts]

This can now be configured through the constructor of OpenIdConfiguration.

For standalone jetty there is a setting which can be configured in the openid.ini file.
You can set

jetty.openid.authMethod=client_secret_basic