3 people 8656f03aae fix(openid): pin token endpoint auth method instead of probing (#3607) ...

Vikunja leaves `oauth2.Config.Endpoint.AuthStyle` at
`AuthStyleAutoDetect`, so `golang.org/x/oauth2` tries
`client_secret_basic`, retries with `client_secret_post` on *any* error,
and reports only the second error — turning every token endpoint failure
(a wrong client secret, say) into a bogus "the client registration does
not allow client_secret_post" complaint.

Style now comes from the provider's
`token_endpoint_auth_methods_supported` discovery value. Provider
advertises neither: keep autodetect, so nothing changes for providers
with a thin discovery document.

Side effect: one token request per login instead of two, no more
spurious failed-auth entry in provider logs on every successful login.

Reported at
https://community.vikunja.io/t/authelia-could-not-authenticate-against-third-party/4770

## How to verify

1. Register a Vikunja client in an OIDC provider that only accepts
`client_secret_basic` (Authelia: `token_endpoint_auth_method:
'client_secret_basic'`).
2. Configure that provider under `auth.openid.providers` in Vikunja, but
put a deliberately wrong value in `clientsecret`.
3. Log in through that provider and read the Vikunja log.
4. **Expected:** the error names the real problem — an `invalid_client`
/ "client secret did not match" message from the provider.
**Before this PR:** the error claimed the client registration does not
allow `client_secret_post`, which was never configured on either side.
5. Fix `clientsecret` to the correct value and log in again.
6. **Expected:** login succeeds, and the provider's access log shows a
single `POST /token` per login rather than a rejected one followed by an
accepted one.

---------

Co-authored-by: kolaente <k@knt.li>

2026-08-27 12:43:11 +00:00

..

cron.go

…

logout_test.go

…

logout.go

…

main_test.go

…

openid_test.go

…

openid.go

…

providers_test.go

…

providers.go

…

status_test.go

…

status.go

…