client-authentication

OAuth 2.0 token endpoints support seven client authentication methods: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, and none, ensuring flexible identity verification for confidential clients.

JWT assertion validation involves verifying JWS signatures and checking the iss, sub, and aud claims against the token endpoint and JWKS. This ensures the JWT was issued by the correct authenticated client for the intended recipient.

mTLS client authentication validates client certificates against either the Subject DN or the full certificate with flexible matching, enforcing strict per-tenant client verification directly within the enterprise IdP core.

Strict per-tenant client verification is enforced across multiple authentication methods by handling JWT assertions and mTLS certificate checks within the IdP core and extension modules, supporting enterprise multi-tenant deployments.

private_key_jwt authenticates clients by validating a signed JWT assertion against JWKS, while tls_client_auth validates the client certificate directly during the TLS handshake, both avoiding the transmission of shared secrets.

An IdP server configured with the client-authentication module is required to validate JWT assertions for client_secret_jwt and private_key_jwt, handling JWS signature validation and JWKS lookups during token requests.