Fix DPoP Proof Generation

[aniket-okta]

Fixes the issue #758

📌 What This PR Fixes

• Invalid DPoP Proof: Corrected JWT header structure to avoid IDX11025 serialization errors.
• Access Denied: Ensured dpop_bound_access_tokens is enabled during client setup.
• Session Errors (E0000005): Added API token authentication to requests.

❓ Why This Change Is Necessary

• Security: DPoP binds tokens to the client’s public key, preventing replay attacks.
• Compliance: Okta’s API requires specific payload structures for DPoP-enabled clients.

🔧 Changes Made

1. DPoP Proof Generation
   • Restructured jwk header to include only kty, e, n, alg, and use.
   • Fixed duplicate header claims (e.g., typ and alg).
   • Added nonce support for retries after use_dpop_nonce errors.
2. Testing
   • Added Integration Test: Validates end-to-end flow for DPoP-bound token issuance.

🐛 Debugging Process

• JWT Inspection: Used tools like [JWT.io](http://jwt.io/) to decode and validate DPoP proof structure.
• API Logs: Analyzed Okta system logs to trace access_denied errors to missing client settings.
• Postman Testing: Verified payload correctness against Okta’s API documentation.

🧪 Testing

• Integration Test:
  • Ensures DPoP-enabled clients are created programmatically.
  • Validates token issuance with a valid DPoP proof.
  • Confirms token rejection when proof is missing or invalid.

---