Get token with credentials in Authorization header

[woutor]

Hi,

I am integrating mozilla-django-oidc with Hydra. I have set up an authorization/consent server and I am able to initiate the OAuth flow using the mozilla_django_oidc.auth.OIDCAuthenticationBackend at my application.

However, at the point that OIDCAuthenticationBackend wants to obtain the token, I get a 400 Client Error in Django, with Hydra logging HTTP authorization header missing or invalid: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed

The problem is documented here. According to the Hydra developers, the client_id and client_secret should be provided in the Authorization header instead of POST parameters.

Right now, I don't see any other way than reimplementing/copying the OIDCAuthenticationBackend.authenticate() method in my custom backend. However, It would be very nice if I could only extend/hook/plug/configure how the client_id and client_secrets are passed to the remote token endpoint.

Thanking you in advance,
Wouter