RFC 8414 implementation missing none from token_endpoint_auth_methods_supported

[jpda]

none is valid per RFC 8414, but not included by default, which is causing some compatibility headaches with certain clients, in particular Claude.

RFC8414 points to RFC7591's token_endpoint_auth_method as the list to use. OIDC points to OIDC Core, but only a specific list of types (of which none is not included).

We're getting around it by deriving from DefaultDiscoveryGenerator, running base and finding that key, modifying its value, but it would be nice to have either a more granular option for modifying this document or some sort of opt-in for 8414 behavior (there may be other behavior differences between OIDC discovery and 8414, I haven't investigated others yet).

For OIDC, since none is defined in Core sec 9 and not mentioned in the option list, with others 'defined by extensions,' it seems like including it could be defensibly interpreted as valid or invalid. It's not in the options, and it's not an extension. I'll defer to you all on your opinion there.

thanks!

RFC8414 sec 2:

token_endpoint_auth_methods_supported

OPTIONAL. JSON array containing a list of client authentication methods supported by this token endpoint. Client authentication method values are used in the "token_endpoint_auth_method" parameter defined in Section 2 of [RFC7591]. If omitted, the default is "client_secret_basic" -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].

7591 sec 2 includes none as a valid value:

token_endpoint_auth_method
String indicator of the requested authentication method for the token endpoint. Values defined by this specification are:

"none": The client is a public client as defined in OAuth 2.0, Section 2.1, and does not have a client secret.
... other methods omitted for brevity

OIDC Discovery 1.0 does not mention none in the list it defines, although none is a valid value per OIDC Core sec 9.

token_endpoint_auth_methods_supported
OPTIONAL. JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0 [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].

[wcabus]

Hi @jpda, I have asked our engineering team to have a look at this.

Personally, I would add a configuration option to Duende IdentityServer to statically add "none" to the list of "token_endpoint_auth_method": this doesn't alter the existing behavior because it would be opt-in, while having no performance impact because IdentityServer doesn't need to look at the list of configured clients to detect whether there is at least one public client.