Description

client_secret is currently a required attribute to use the openid-connect plugin. However, some use cases supported by this plugin seem to not require client_secret:

1. when using authorization code grant with PKCE (brearer_only to false and use_pkce to true), client_secret is not needed.
2. when using private_key_jwt as the token_endpoint_auth_method, client_secret is not needed and client_rsa_private_key is used instead.

This issue is a discussion thread that evaluates whether we should toggle client_secret requirement to false and add relevant test cases if needed. Thoughts welcomed.

Environment

• APISIX version (run apisix version): 3.7.0