From f7ef2de4e986ff4a41b34297801e76e029a94d16 Mon Sep 17 00:00:00 2001 From: Mabe Date: Sun, 21 Jun 2026 16:55:34 +0200 Subject: [PATCH] fix: update auth_callback to support HTTP Basic auth for OIDC providers --- backend/app/main.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/backend/app/main.py b/backend/app/main.py index 1d815e8..0a67f3b 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -75,16 +75,21 @@ async def auth_callback(payload: AuthCallbackRequest): data = { "grant_type": "authorization_code", - "client_id": settings.oidc_client_id, "code": payload.code, "code_verifier": payload.code_verifier, "redirect_uri": str(payload.redirect_uri), } + + # Some OIDC providers expect client credentials via HTTP Basic auth + auth = None if settings.oidc_client_secret: - data["client_secret"] = settings.oidc_client_secret + auth = (settings.oidc_client_id, settings.oidc_client_secret) + else: + # public client: include client_id in the request body + data["client_id"] = settings.oidc_client_id async with httpx.AsyncClient(timeout=15.0) as client: - response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"}) + response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"}, auth=auth) if response.status_code != 200: raise HTTPException(status_code=400, detail=f"OIDC token exchange failed: {response.text}")