From 63965261db2d6d35bbb172b3e1e35098f148d4b3 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Mon, 23 Mar 2026 15:51:34 +0100 Subject: [PATCH] Fix Microsoft OIDC token exchange auth style Without an explicit AuthStyle, the oauth2 library uses auto-detection which tries Basic auth first. Microsoft rejects this, and since PKCE codes are single-use, the retry with the correct style fails. Signed-off-by: Bryan Frimin --- pkg/iam/oidc/service.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/iam/oidc/service.go b/pkg/iam/oidc/service.go index b92601657..bd3b93fb4 100644 --- a/pkg/iam/oidc/service.go +++ b/pkg/iam/oidc/service.go @@ -146,8 +146,9 @@ var ( } microsoftEndpoint = oauth2.Endpoint{ - AuthURL: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", - TokenURL: "https://login.microsoftonline.com/common/oauth2/v2.0/token", + AuthURL: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", + TokenURL: "https://login.microsoftonline.com/common/oauth2/v2.0/token", + AuthStyle: oauth2.AuthStyleInParams, } )