From b79f1b2a2956362d0602f35f9c042bf26f0c1da2 Mon Sep 17 00:00:00 2001
From: Karl Persson <23356117+kalleep@users.noreply.github.com>
Date: Thu, 23 Jan 2025 13:04:51 +0100
Subject: [PATCH] AuzerAD: Handle empty `client_authentication` case (#99437)

AuzerAD: Require client secret when client_authentication is set to empty string
---
 pkg/login/social/connectors/azuread_oauth.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/login/social/connectors/azuread_oauth.go b/pkg/login/social/connectors/azuread_oauth.go
index 66bc53db788..0f4a72ed5a7 100644
--- a/pkg/login/social/connectors/azuread_oauth.go
+++ b/pkg/login/social/connectors/azuread_oauth.go
@@ -373,7 +373,7 @@ func validateClientAuthentication(info *social.OAuthInfo, requester identity.Req
 		}
 		return nil
 
-	case social.ClientSecretPost:
+	case social.ClientSecretPost, "":
 		if info.ClientSecret == "" {
 			return ssosettings.ErrInvalidOAuthConfig("Client secret is required for Client secret authentication.")
 		}