From 125fdc8f2176318631b8333d4e487b2e382837f5 Mon Sep 17 00:00:00 2001
From: Misi <mgyongyosi@users.noreply.github.com>
Date: Wed, 15 Jan 2025 16:49:58 +0100
Subject: [PATCH] Auth: Fix AzureAD public client configuration (#99019)

Auth: Add client auth none as default to ensure public clients can be configured on the UI
---
 pkg/login/social/connectors/azuread_oauth.go | 5 ++++-
 pkg/login/social/social.go                   | 1 +
 public/app/features/auth-config/fields.tsx   | 8 ++++++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkg/login/social/connectors/azuread_oauth.go b/pkg/login/social/connectors/azuread_oauth.go
index cd2e81367b5..66bc53db788 100644
--- a/pkg/login/social/connectors/azuread_oauth.go
+++ b/pkg/login/social/connectors/azuread_oauth.go
@@ -199,7 +199,7 @@ func (s *SocialAzureAD) Exchange(ctx context.Context, code string, authOptions .
 	case social.ClientSecretPost:
 		// Default behavior for ClientSecretPost, no additional setup needed
 	default:
-		s.log.Debug("ClientAuthentication is not set. Using default client authentication method")
+		s.log.Debug("ClientAuthentication is not set. Using default client authentication method: none")
 	}
 
 	// Default token exchange
@@ -379,6 +379,9 @@ func validateClientAuthentication(info *social.OAuthInfo, requester identity.Req
 		}
 		return nil
 
+	case social.None:
+		return nil
+
 	default:
 		return ssosettings.ErrInvalidOAuthConfig("Invalid client authentication method.")
 	}
diff --git a/pkg/login/social/social.go b/pkg/login/social/social.go
index 172c8de58a0..741d02098a9 100644
--- a/pkg/login/social/social.go
+++ b/pkg/login/social/social.go
@@ -16,6 +16,7 @@ const (
 
 	// Values for ClientAuthentication under OAuthInfo (based on oidc spec)
 	ClientSecretPost = "client_secret_post"
+	None             = "none"
 	// Azure AD
 	ManagedIdentity = "managed_identity"
 	// Other providers...
diff --git a/public/app/features/auth-config/fields.tsx b/public/app/features/auth-config/fields.tsx
index d11d4eb9707..4ac00ed7c21 100644
--- a/public/app/features/auth-config/fields.tsx
+++ b/public/app/features/auth-config/fields.tsx
@@ -258,7 +258,7 @@ export function fieldMap(provider: string): Record<string, FieldData> {
       description: 'The client authentication method used to authenticate to the token endpoint.',
       multi: false,
       options: clientAuthenticationOptions(provider),
-      defaultValue: { value: 'client_secret_post', label: 'Client secret' },
+      defaultValue: { value: 'none', label: 'None' },
       validation: {
         required: true,
         message: 'This field is required',
@@ -683,11 +683,15 @@ function clientAuthenticationOptions(provider: string): Array<SelectableValue<st
   switch (provider) {
     case 'azuread':
       return [
+        { value: 'none', label: 'None' },
         { value: 'client_secret_post', label: 'Client secret' },
         { value: 'managed_identity', label: 'Managed identity' },
       ];
     // Other providers ...
     default:
-      return [{ value: 'client_secret_post', label: 'Client secret' }];
+      return [
+        { value: 'none', label: 'None' },
+        { value: 'client_secret_post', label: 'Client secret' },
+      ];
   }
 }