[FLI-748] Auth(OIDC/OAuth): Support AuthStyle config about flipt

[souradeepmajumdar05]

@markphelps can you attach steps to replicate this, would like to take this up
changes should be around auth_grpc.pb.go#L472

[markphelps]

Hey @souradeepmajumdar05 !!

So im trying to see if this is something that is possible for us to 'fix', as it seems like it should be working looking through our code as well as the underlying libraries.

Here's what I've found so far:

1. It starts here at the OIDC callback handler where the provider successfully calls back to Flipt to initiate the code/token exchange:

   flipt/internal/server/auth/method/oidc/server.go

   Line 131 in ee2e727

   responseToken, err := provider.Exchange(ctx, oidcRequest, req.State, req.Code)

2. We get the configured provider and initiate the exchange
3. It calls the Hashicorp Cap OIDC provider exchange method: https://github.com/hashicorp/cap/blob/1d58e0e8bd5f948b9d2bebe8b25a81eb0288fe32/oidc/provider.go#L261
4. This eventually calls the underlying oauth2.Exchange method here: https://github.com/golang/oauth2/blob/6e9ec9323da7adcd2cc6e62e4deb9fae4c309a1a/oauth2.go#L223
5. This calls retrieveToken: https://github.com/golang/oauth2/blob/6e9ec9323da7adcd2cc6e62e4deb9fae4c309a1a/token.go#L166
6. Which calls internal.RetrieveToken: https://github.com/golang/oauth2/blob/6e9ec9323da7adcd2cc6e62e4deb9fae4c309a1a/internal/token.go#L212
7. Which gets down here: https://github.com/golang/oauth2/blob/6e9ec9323da7adcd2cc6e62e4deb9fae4c309a1a/internal/token.go#L212

Looking at this logic, it should actually try both ways (Auth in header first, then Auth in body) and cache the result for the provider for future calls.

And since we don't currently expose setting the AuthStyle at all in Flipt, it should use the default 0 value, which according to the code is AutoDetect: https://github.com/golang/oauth2/blob/master/oauth2.go#L85

This should mean that Flipt essentially tries both ways to exchange the code, first in the header as requested per this issue, then in the body.. unless we are using an outdated version of the oauth2 dependency..

Let me dive in some more and check

[markphelps]

go list -m all | grep x/oauth2
golang.org/x/oauth2 v0.15.0

which is the latest version: https://pkg.go.dev/golang.org/x/oauth2 which should contain the code/perform as described above

https://cs.opensource.google/go/x/oauth2/+/refs/tags/v0.15.0:internal/token.go;l=212

Gonna ask the OP in Discord to help debug this one