feat: add support for specifying a clientAuthenticationMethod for OIDC (#1178)

* feat: add support for specifying a clientAuthenticationMethod for OIDC (#1158)

* feat: add support for specifying a clientAuthenticationMethod for OIDC

* Update crates/stackable-operator/src/crd/authentication/oidc/mod.rs

Co-authored-by: Techassi <git@techassi.dev>

* Update crates/stackable-operator/src/crd/authentication/oidc/mod.rs

Co-authored-by: Techassi <git@techassi.dev>

* chore: remove unnecessary serde attributes

---------

Co-authored-by: Techassi <git@techassi.dev>

* chore: Update changelog

---------

Co-authored-by: Lukas Krug <lukas@luvosys.de>
Co-authored-by: Techassi <git@techassi.dev>

Author: 3 people

crates/stackable-operator/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Add support for specifying a `clientAuthenticationMethod` for OIDC ([#1178]).
+  This was originally done in [#1158] and had been reverted in [#1170].
+
+[#1178]: https://github.com/stackabletech/operator-rs/pull/1178
+
 ## [0.108.0] - 2026-03-10
 
 ### Removed

crates/stackable-operator/crds/DummyCluster.yaml

@@ -30,6 +30,16 @@ spec:
                     description: This field contains OIDC-specific configuration. It is only required in case OIDC is used.
                     nullable: true
                     properties:
+                      clientAuthenticationMethod:
+                        default: client_secret_basic
+                        description: 'The client authentication method used when communicating with the token endpoint. Defaults to `client_secret_basic`. The required contents of `clientCredentialsSecret` depend on the chosen method: secret-based methods (`client_secret_basic`, `client_secret_post`, `client_secret_jwt`) expect a client secret, while `private_key_jwt` expects a private key.'
+                        enum:
+                        - client_secret_basic
+                        - client_secret_post
+                        - client_secret_jwt
+                        - private_key_jwt
+                        - none
+                        type: string
                       clientCredentialsSecret:
                         description: |-
                           A reference to the OIDC client credentials secret. The secret contains

crates/stackable-operator/src/crd/authentication/oidc/mod.rs

@@ -90,6 +90,46 @@ pub mod versioned {
         Keycloak,
     }
 
+    /// OAuth2 client authentication methods as defined in the OpenID Connect Core spec.
+    ///
+    /// These methods are used by clients to authenticate to the authorization server
+    /// when using the token endpoint.
+    ///
+    /// See <https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication> for details.
+    #[derive(
+        Clone,
+        Copy,
+        Debug,
+        Default,
+        Deserialize,
+        Eq,
+        Hash,
+        JsonSchema,
+        Ord,
+        PartialEq,
+        PartialOrd,
+        Serialize,
+    )]
+    #[serde(rename_all = "snake_case")]
+    pub enum ClientAuthenticationMethod {
+        /// Authenticate using HTTP Basic authentication with client_id and client_secret.
+        /// This is the default method according to the OIDC spec.
+        #[default]
+        ClientSecretBasic,
+
+        /// Send client_id and client_secret in the request body.
+        ClientSecretPost,
+
+        /// Authenticate using a JWT signed with an HMAC SHA algorithm using the client_secret.
+        ClientSecretJwt,
+
+        /// Authenticate using a JWT signed with the client's private key.
+        PrivateKeyJwt,
+
+        /// No client authentication (for public clients or implicit flow).
+        None,
+    }
+
     /// OIDC specific config options. These are set on the product config level.
     #[derive(
         Clone, Debug, Deserialize, Eq, Hash, JsonSchema, Ord, PartialEq, PartialOrd, Serialize,
@@ -111,6 +151,25 @@ pub mod versioned {
         #[serde(default)]
         pub extra_scopes: Vec<String>,
 
+        /// The OAuth2 client authentication method to use for token endpoint requests.
+        /// Defaults to [`ClientAuthenticationMethod::ClientSecretBasic`].
+        ///
+        /// The contents and format of the `clientCredentialsSecret` depend on the selected
+        /// method. For example, [`ClientAuthenticationMethod::ClientSecretBasic`] and
+        /// [`ClientAuthenticationMethod::ClientSecretPost`] require a client secret string, whereas
+        /// [`ClientAuthenticationMethod::PrivateKeyJwt`] requires a private key.
+        ///
+        /// See [`ClientAuthenticationMethod`] for available options.
+        #[schemars(
+            description = "The client authentication method used when communicating with the token \
+            endpoint. Defaults to `client_secret_basic`. The required contents of \
+            `clientCredentialsSecret` depend on the chosen method: secret-based methods \
+            (`client_secret_basic`, `client_secret_post`, `client_secret_jwt`) expect a client \
+            secret, while `private_key_jwt` expects a private key."
+        )]
+        #[serde(default)]
+        pub client_authentication_method: ClientAuthenticationMethod,
+
         // If desired, operators can add custom fields that are only needed for this specific product.
         // They need to create a struct holding them and pass that as `T`.
         #[serde(flatten)]