PingAM

OIDC client authentication

OIDC clients can use the authentication methods described in OAuth 2.0 client authentication. Set the authentication method in the client profile:

  1. In the AM admin UI, go to Realms > realm name > Applications > OAuth 2.0 > Clients > client ID.

  2. On the Advanced tab, select the method from the Token Endpoint Authentication Method list:

    Method Description

    client_secret_basic (default)

    The client sends its credentials in an HTTP Basic Authorization header.

    client_secret_post

    The client sends its credentials as client_id and client_secret form parameters.

    When a client authenticates with form parameters, the server can store POST data on the user-agent in an OAUTH_REQUEST_ATTRIBUTES cookie. AM uses the cookie to continue the authentication process across redirects. It marks the cookie for deletion on the next successful OAuth 2.0 authorization.

    none

    The client is public and doesn’t authenticate.

    Public clients don’t authenticate even if the authentication method is different from none.

    private_key_jwt

    The client sends its credentials as a JSON Web Token (JWT).

    self_signed_tls_client_auth

    The client uses a self-signed certificate for mutual TLS authentication.

    tls_client_auth

    The client uses a CA-signed certificate for mutual TLS authentication.

  3. Click Save Changes.