ClientAuthenticationMethod class final

How the client proves who it is to the provider's token endpoint.

A server (a confidential client) has a secret and sends it either in the Authorization header (clientSecretBasic, the default) or in the form (clientSecretPost). An app (a public client) has no secret, since anyone could extract it: it uses none, and PKCE protects its codes instead. The registration's client-authentication-method property picks one; without it, a registration with no secret gets none.

spring.security.oauth2.client.registration.keycloak.client-authentication-method=client_secret_post

Spring (Java): ClientAuthenticationMethod. client_secret_jwt, private_key_jwt and tls_client_auth exist as values but the token clients refuse them.

Constructors

ClientAuthenticationMethod(String value)

A method named value, as in the properties and the provider's metadata.

const

Properties

hashCode → int

The hash code for this object.

no setter, override

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

value → String

The name, such as client_secret_basic.

final

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

override

Operators

operator ==(Object other) → bool

The equality operator.

override

Constants

clientSecretBasic → const ClientAuthenticationMethod

client_secret_basic: the id and secret in HTTP Basic (RFC 6749 §2.3.1).

clientSecretJwt → const ClientAuthenticationMethod

client_secret_jwt (not supported by the token clients).

clientSecretPost → const ClientAuthenticationMethod

client_secret_post: the id and secret as form parameters.

none → const ClientAuthenticationMethod

none: a public client, only its client_id is sent.

privateKeyJwt → const ClientAuthenticationMethod

private_key_jwt (not supported by the token clients).