mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-31 12:45:51 -05:00
8656f03aae
Vikunja leaves `oauth2.Config.Endpoint.AuthStyle` at `AuthStyleAutoDetect`, so `golang.org/x/oauth2` tries `client_secret_basic`, retries with `client_secret_post` on *any* error, and reports only the second error — turning every token endpoint failure (a wrong client secret, say) into a bogus "the client registration does not allow client_secret_post" complaint. Style now comes from the provider's `token_endpoint_auth_methods_supported` discovery value. Provider advertises neither: keep autodetect, so nothing changes for providers with a thin discovery document. Side effect: one token request per login instead of two, no more spurious failed-auth entry in provider logs on every successful login. Reported at https://community.vikunja.io/t/authelia-could-not-authenticate-against-third-party/4770 ## How to verify 1. Register a Vikunja client in an OIDC provider that only accepts `client_secret_basic` (Authelia: `token_endpoint_auth_method: 'client_secret_basic'`). 2. Configure that provider under `auth.openid.providers` in Vikunja, but put a deliberately wrong value in `clientsecret`. 3. Log in through that provider and read the Vikunja log. 4. **Expected:** the error names the real problem — an `invalid_client` / "client secret did not match" message from the provider. **Before this PR:** the error claimed the client registration does not allow `client_secret_post`, which was never configured on either side. 5. Fix `clientsecret` to the correct value and log in again. 6. **Expected:** login succeeds, and the provider's access log shows a single `POST /token` per login rather than a rejected one followed by an accepted one. --------- Co-authored-by: kolaente <k@knt.li>