From da0196b46973c4885bd58c9a4e1ebef34bc9fc01 Mon Sep 17 00:00:00 2001 From: Mabe Date: Sun, 21 Jun 2026 17:03:43 +0200 Subject: [PATCH] fix: update auth_callback to include client_id in POST body for OIDC providers --- backend/app/main.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/app/main.py b/backend/app/main.py index ba88ce4..a37d229 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -78,21 +78,22 @@ async def auth_callback(payload: AuthCallbackRequest): "code": payload.code, "code_verifier": payload.code_verifier, "redirect_uri": str(payload.redirect_uri), - "client_id": settings.oidc_client_id, } # Some OIDC providers expect client credentials via HTTP Basic auth auth = None if settings.oidc_client_secret: auth = (settings.oidc_client_id, settings.oidc_client_secret) + else: + data["client_id"] = settings.oidc_client_id async with httpx.AsyncClient(timeout=15.0) as client: response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"}, auth=auth) # Some providers only accept client authentication via POST body if response.status_code != 200 and auth is not None: - # try falling back to client_secret in the request body data_with_secret = dict(data) + data_with_secret["client_id"] = settings.oidc_client_id data_with_secret["client_secret"] = settings.oidc_client_secret response = await client.post(token_endpoint, data=data_with_secret, headers={"Accept": "application/json"})