Description
Discord's OpenID discovery document (https://discord.com/.well-known/openid-configuration) omits token_endpoint_auth_methods_supported. While OpenID Connect Discovery 1.0 §3 makes this field optional (defaulting to client_secret_basic), major federation consumers require it: Microsoft Entra External ID rejects Discord as a custom OIDC identity provider with:
Custom OIDC well-known endpoint validation error: Error when deserializing response Required property 'token_endpoint_auth_methods_supported' not found in JSON.
per Microsoft's documented minimum metadata requirements ("At a minimum, the metadata document must contain: issuer, authorization_endpoint, token_endpoint, token_endpoint_auth_methods_supported, response_types_supported, subject_types_supported, and jwks_uri").
This blocks "Sign in with Discord" federation into Entra External ID (and any similarly strict consumer) even though Discord's OIDC endpoints themselves work correctly.
Steps to Reproduce
In a Microsoft Entra External ID tenant, add a custom OpenID Connect identity provider with well-known endpoint https://discord.com/.well-known/openid-configuration — creation fails with the validation error above (also reproducible via Microsoft Graph POST /identity/identityProviders).
Hosting a copy of the discovery document with only this one field added (all endpoints unchanged) makes the same configuration succeed, confirming the missing field is the sole blocker.
Expected Behavior
The discovery document advertises the token endpoint's accepted client authentication methods, e.g.:
"token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"]
(whichever methods the token endpoint actually accepts) — analogous to the userinfo_endpoint addition made for #7377.
Description
Discord's OpenID discovery document (https://discord.com/.well-known/openid-configuration) omits
token_endpoint_auth_methods_supported. While OpenID Connect Discovery 1.0 §3 makes this field optional (defaulting toclient_secret_basic), major federation consumers require it: Microsoft Entra External ID rejects Discord as a custom OIDC identity provider with:per Microsoft's documented minimum metadata requirements ("At a minimum, the metadata document must contain: issuer, authorization_endpoint, token_endpoint, token_endpoint_auth_methods_supported, response_types_supported, subject_types_supported, and jwks_uri").
This blocks "Sign in with Discord" federation into Entra External ID (and any similarly strict consumer) even though Discord's OIDC endpoints themselves work correctly.
Steps to Reproduce
In a Microsoft Entra External ID tenant, add a custom OpenID Connect identity provider with well-known endpoint
https://discord.com/.well-known/openid-configuration— creation fails with the validation error above (also reproducible via Microsoft GraphPOST /identity/identityProviders).Hosting a copy of the discovery document with only this one field added (all endpoints unchanged) makes the same configuration succeed, confirming the missing field is the sole blocker.
Expected Behavior
The discovery document advertises the token endpoint's accepted client authentication methods, e.g.:
(whichever methods the token endpoint actually accepts) — analogous to the
userinfo_endpointaddition made for #7377.