Basic authentication header is set regardless of use of basic auth?

[jumbojett]

Basic authentication header is set regardless of use of basic auth?

[EAnushan]

You can disable it as follows:

$oidc->providerConfigParam([
    'token_endpoint_auth_methods_supported' => []
]);

[devicenull]

I think this ends up breaking logging in with Okta, which throws an error. This was mentioned in #75, but I didn't see a great fix.

Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client_assertion in the post body.

Okta's well-known config reports:

  "token_endpoint_auth_methods_supported": Array[5][
    "client_secret_basic",
    "client_secret_post",
    "client_secret_jwt",
    "private_key_jwt",
    "none"
  ],

[abulhol]

This "auto discovery" of the authentication method (Basic vs. POST) is likely not to work properly, I also got stuck on it using OneLogin. Maybe it would be better to remove it altogether, and add a class property authorizationMethod for it and a public setter method. Default should be POST I think.