oidc-caep-risc 0.1.0__tar.gz

oidc_caep_risc-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Iya CyberSecurity Solutions, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

oidc_caep_risc-0.1.0/PKG-INFO

@@ -0,0 +1,83 @@
+Metadata-Version: 2.4
+Name: oidc-caep-risc
+Version: 0.1.0
+Summary: Server-side OpenID Connect confidential client: Authorization Code with PKCE, client authentication, and a CAEP and RISC Shared Signals receiver.
+Author: Iya CyberSecurity Solutions, LLC
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/rcbj/oidc-caep-risc-python
+Project-URL: Repository, https://github.com/rcbj/oidc-caep-risc-python
+Project-URL: Issues, https://github.com/rcbj/oidc-caep-risc-python/issues
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Dynamic: license-file
+
+# oidc-caep-risc
+
+A confidential OpenID Connect relying party for a traditional Python application, and a CAEP and RISC receiver on one Shared Signals poll stream. Authorization Code with PKCE (S256) is required. Client authentication is `client_secret_basic`, `client_secret_post`, or `private_key_jwt`. A public client (`tokenEndpointAuthMethod` `"none"`) is refused. The only cryptographic dependency is `cryptography`.
+
+JSON configuration keys are the same names the Node library `oidc-caep-risc-nodejs` reads. `signals` omitted or `true` keeps CAEP and RISC on. `signals: false` does not start the receiver, does not require transmitter metadata, and drops `ssf.read` and `ssf.manage` from the scope list after the default scopes are applied. `DEFAULT_SCOPES` still names those two scopes. The shipped demo leaves `signals` on (the key is omitted).
+
+The license is MIT. `develop` and `main` are the same commit. A pull request merged into `main` publishes the package to PyPI after the test workflow succeeds on that commit. A direct push does not. There is no API token: PyPI Trusted Publishing trades the workflow's GitHub OIDC token for a short-lived upload token, from the `pypi` environment, and PyPI holds the publisher for this repository and `publish.yml`. A version already on PyPI stays there; the next release is a new `version` in `pyproject.toml` (and `VERSION`).
+
+## Usage
+
+```python
+from oidc_caep_risc import RelyingParty
+
+rp = RelyingParty.from_file("oidc.json")
+request = rp.authorize()
+# redirect the browser to request["url"]; keep state, nonce, and code_verifier
+who = rp.complete(query, request)
+```
+
+Tokens stay in this process. Keep the transaction until the browser returns.
+
+## Tests
+
+```bash
+docker build --target test .
+```
+
+The suite runs in a container.
+
+The tests build an in-process stub provider and a stub transmitter. They do not start iya-sts.
+
+`python3 scripts/live_iya_sts.py` is the live half. It starts the latest main branch of iya-sts in memory mode with persistence and clustering off, runs the install script in a scratch copy of this checkout (which writes the `tlsCa` chain), then builds this demo image from it, checks the image carries the chain, starts the demo with no CA mount and no refresh, signs in, and requires a credential-change event and a session-revoked event on `GET /live-status`. The second event ends the local session. It binds two high ports, never 3000 or 8081. The nightly workflow runs the unit suite and this script once every 24 hours.
+
+## Layout
+
+| Path | What it is |
+|---|---|
+| `src/oidc_caep_risc` | The library. `relying_party.py`, `client_auth.py`, `id_token.py`, `pkce.py`, `discovery.py`, `config.py`, `ssf/`. |
+| `tests` | pytest ports of the Node relying-party and Shared Signals tests. |
+| `demo` | `demo/app.py`, a stdlib `http.server` application. Config is `demo/oidc.json`. |
+| `scripts/configure_iya_sts.py` | Registers the confidential client on iya-sts and creates the test user `oidc-demo-user`. A generated client secret goes to the file `secretFile` names, and a generated password to `demo/generated/oidc-demo-user.password`, each mode 0600; the script prints neither. Loopback redirects follow the running container's `PORT`, then the shell `PORT`. |
+| `Dockerfile`, `docker-compose.yml` | The demo image. Compose uses host networking. |
+
+## The iya-sts trust chain (`tlsCa`)
+
+`tlsCa` in `demo/oidc.json` names the iya-sts TLS listener CA trust chain the library trusts. The default is `generated/idp-ca.pem`, relative to `demo/`. The value may also be `file:<path>`, `env:<NAME>`, or the PEM itself. The library adds every certificate in it to the default trust store.
+
+`scripts/configure_iya_sts.py`, the install script, writes that file. It saves the whole chain iya-sts publishes at `GET /tls/server-certificate` (leaf, TLS Issuing CA, Intermediate, Root), or the chain from the TLS handshake when that path does not answer. It prints the path, the trust anchor's subject and its SHA-256 fingerprint. Compare the anchor with the Root CA on iya-sts's PKI page.
+
+The demo image build copies that file into the image at `/app/demo/generated/idp-ca.pem`, so the image trusts that iya-sts with no bind mount and no fetch. Run the install script before you build the image. Rebuild the image after running the install script against a different iya-sts. `.dockerignore` admits only that file from `demo/generated`. The client secret stays out of the image. A build with no chain file yet (a fresh clone, CI) still succeeds; the image then has no `tlsCa` file.
+
+The container entrypoint also refreshes the file from the provider at start, because a development iya-sts makes a new CA when it restarts. A failed refresh keeps the file from the build. `TLS_CA_REFRESH=0` turns the refresh off. `python scripts/trust_chain.py --config demo/oidc.json` refreshes it by hand.
+
+## Demo
+
+`PORT` defaults to 3000. A loopback redirect and post-logout URL follow `PORT`. Any other host is left as written. An explicit `PUBLIC_URL` or `--public-url` replaces the origin and keeps the path. The default `http://localhost:3000` is not an explicit public URL.
+
+```sh
+docker compose up --build
+```
+
+`GET /healthz` returns `ok`. `GET /` is the page. `GET /login` starts `authorize` and redirects. `GET /callback` completes the code exchange. `POST /logout` signs the local session out. `GET /live-status` is JSON: `signedIn`, `subject`, the receiver state, and the Shared Signals events this process has accepted.
+
+`docker-compose.yml` sets `network_mode: host`. The image sets `ENV PORT=3000`. The health check calls `http://127.0.0.1:${PORT}/healthz`. The running container's `PORT` wins over the shell's when `scripts/configure_iya_sts.py` registers the application.
+
+Demo JSON uses `file:` and the configuration's own placeholders. It does not contain a generated secret or key.

oidc_caep_risc-0.1.0/README.md

@@ -0,0 +1,66 @@
+# oidc-caep-risc
+
+A confidential OpenID Connect relying party for a traditional Python application, and a CAEP and RISC receiver on one Shared Signals poll stream. Authorization Code with PKCE (S256) is required. Client authentication is `client_secret_basic`, `client_secret_post`, or `private_key_jwt`. A public client (`tokenEndpointAuthMethod` `"none"`) is refused. The only cryptographic dependency is `cryptography`.
+
+JSON configuration keys are the same names the Node library `oidc-caep-risc-nodejs` reads. `signals` omitted or `true` keeps CAEP and RISC on. `signals: false` does not start the receiver, does not require transmitter metadata, and drops `ssf.read` and `ssf.manage` from the scope list after the default scopes are applied. `DEFAULT_SCOPES` still names those two scopes. The shipped demo leaves `signals` on (the key is omitted).
+
+The license is MIT. `develop` and `main` are the same commit. A pull request merged into `main` publishes the package to PyPI after the test workflow succeeds on that commit. A direct push does not. There is no API token: PyPI Trusted Publishing trades the workflow's GitHub OIDC token for a short-lived upload token, from the `pypi` environment, and PyPI holds the publisher for this repository and `publish.yml`. A version already on PyPI stays there; the next release is a new `version` in `pyproject.toml` (and `VERSION`).
+
+## Usage
+
+```python
+from oidc_caep_risc import RelyingParty
+
+rp = RelyingParty.from_file("oidc.json")
+request = rp.authorize()
+# redirect the browser to request["url"]; keep state, nonce, and code_verifier
+who = rp.complete(query, request)
+```
+
+Tokens stay in this process. Keep the transaction until the browser returns.
+
+## Tests
+
+```bash
+docker build --target test .
+```
+
+The suite runs in a container.
+
+The tests build an in-process stub provider and a stub transmitter. They do not start iya-sts.
+
+`python3 scripts/live_iya_sts.py` is the live half. It starts the latest main branch of iya-sts in memory mode with persistence and clustering off, runs the install script in a scratch copy of this checkout (which writes the `tlsCa` chain), then builds this demo image from it, checks the image carries the chain, starts the demo with no CA mount and no refresh, signs in, and requires a credential-change event and a session-revoked event on `GET /live-status`. The second event ends the local session. It binds two high ports, never 3000 or 8081. The nightly workflow runs the unit suite and this script once every 24 hours.
+
+## Layout
+
+| Path | What it is |
+|---|---|
+| `src/oidc_caep_risc` | The library. `relying_party.py`, `client_auth.py`, `id_token.py`, `pkce.py`, `discovery.py`, `config.py`, `ssf/`. |
+| `tests` | pytest ports of the Node relying-party and Shared Signals tests. |
+| `demo` | `demo/app.py`, a stdlib `http.server` application. Config is `demo/oidc.json`. |
+| `scripts/configure_iya_sts.py` | Registers the confidential client on iya-sts and creates the test user `oidc-demo-user`. A generated client secret goes to the file `secretFile` names, and a generated password to `demo/generated/oidc-demo-user.password`, each mode 0600; the script prints neither. Loopback redirects follow the running container's `PORT`, then the shell `PORT`. |
+| `Dockerfile`, `docker-compose.yml` | The demo image. Compose uses host networking. |
+
+## The iya-sts trust chain (`tlsCa`)
+
+`tlsCa` in `demo/oidc.json` names the iya-sts TLS listener CA trust chain the library trusts. The default is `generated/idp-ca.pem`, relative to `demo/`. The value may also be `file:<path>`, `env:<NAME>`, or the PEM itself. The library adds every certificate in it to the default trust store.
+
+`scripts/configure_iya_sts.py`, the install script, writes that file. It saves the whole chain iya-sts publishes at `GET /tls/server-certificate` (leaf, TLS Issuing CA, Intermediate, Root), or the chain from the TLS handshake when that path does not answer. It prints the path, the trust anchor's subject and its SHA-256 fingerprint. Compare the anchor with the Root CA on iya-sts's PKI page.
+
+The demo image build copies that file into the image at `/app/demo/generated/idp-ca.pem`, so the image trusts that iya-sts with no bind mount and no fetch. Run the install script before you build the image. Rebuild the image after running the install script against a different iya-sts. `.dockerignore` admits only that file from `demo/generated`. The client secret stays out of the image. A build with no chain file yet (a fresh clone, CI) still succeeds; the image then has no `tlsCa` file.
+
+The container entrypoint also refreshes the file from the provider at start, because a development iya-sts makes a new CA when it restarts. A failed refresh keeps the file from the build. `TLS_CA_REFRESH=0` turns the refresh off. `python scripts/trust_chain.py --config demo/oidc.json` refreshes it by hand.
+
+## Demo
+
+`PORT` defaults to 3000. A loopback redirect and post-logout URL follow `PORT`. Any other host is left as written. An explicit `PUBLIC_URL` or `--public-url` replaces the origin and keeps the path. The default `http://localhost:3000` is not an explicit public URL.
+
+```sh
+docker compose up --build
+```
+
+`GET /healthz` returns `ok`. `GET /` is the page. `GET /login` starts `authorize` and redirects. `GET /callback` completes the code exchange. `POST /logout` signs the local session out. `GET /live-status` is JSON: `signedIn`, `subject`, the receiver state, and the Shared Signals events this process has accepted.
+
+`docker-compose.yml` sets `network_mode: host`. The image sets `ENV PORT=3000`. The health check calls `http://127.0.0.1:${PORT}/healthz`. The running container's `PORT` wins over the shell's when `scripts/configure_iya_sts.py` registers the application.
+
+Demo JSON uses `file:` and the configuration's own placeholders. It does not contain a generated secret or key.

oidc_caep_risc-0.1.0/pyproject.toml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+[project]
+name = "oidc-caep-risc"
+version = "0.1.0"
+description = "Server-side OpenID Connect confidential client: Authorization Code with PKCE, client authentication, and a CAEP and RISC Shared Signals receiver."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Iya CyberSecurity Solutions, LLC" }]
+dependencies = ["cryptography"]
+
+[project.optional-dependencies]
+dev = ["pytest"]
+
+[project.scripts]
+oidc-caep-risc = "oidc_caep_risc.cli:main"
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[project.urls]
+Homepage = "https://github.com/rcbj/oidc-caep-risc-python"
+Repository = "https://github.com/rcbj/oidc-caep-risc-python"
+Issues = "https://github.com/rcbj/oidc-caep-risc-python/issues"

oidc_caep_risc-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

oidc_caep_risc-0.1.0/src/oidc_caep_risc/__init__.py

@@ -0,0 +1,59 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""A server-side OpenID Connect confidential client, and one CAEP/RISC poll stream.
+
+    rp = RelyingParty.from_file("oidc.json")
+    request = rp.authorize()
+    who = rp.complete(query, request)
+"""
+
+from .config import read_config_file, resolve_config
+from .discovery import (
+    ASYMMETRIC_JWS_ALGS,
+    DEFAULT_SCOPES,
+    discover_provider,
+    issuer_from_metadata_url,
+    validate_provider_metadata,
+    well_known_urls,
+)
+from .errors import OidcError
+from .id_token import hash_claim, validate_id_token
+from .pkce import code_challenge_s256, random_token
+from .relying_party import RelyingParty
+from .ssf import (
+    CAEP_EVENTS,
+    DEFAULT_ENDING_EVENTS,
+    DEFAULT_EVENTS_REQUESTED,
+    EVENT,
+    RISC_EVENTS,
+    MemorySessionIndex,
+    SignalsReceiver,
+    subject_of,
+    tracked_from_login,
+)
+
+__all__ = [
+    "ASYMMETRIC_JWS_ALGS",
+    "CAEP_EVENTS",
+    "DEFAULT_ENDING_EVENTS",
+    "DEFAULT_EVENTS_REQUESTED",
+    "DEFAULT_SCOPES",
+    "EVENT",
+    "RISC_EVENTS",
+    "MemorySessionIndex",
+    "OidcError",
+    "RelyingParty",
+    "SignalsReceiver",
+    "code_challenge_s256",
+    "discover_provider",
+    "hash_claim",
+    "issuer_from_metadata_url",
+    "random_token",
+    "read_config_file",
+    "resolve_config",
+    "subject_of",
+    "tracked_from_login",
+    "validate_id_token",
+    "validate_provider_metadata",
+    "well_known_urls",
+]

oidc_caep_risc-0.1.0/src/oidc_caep_risc/b64.py

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Base64url without padding, the form JOSE and PKCE use."""
+
+import base64
+import re
+
+_B64URL = re.compile(r"^[A-Za-z0-9_-]*$")
+
+
+def b64url_encode(data):
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def b64url_decode(value, what="value"):
+    if not isinstance(value, str) or not _B64URL.fullmatch(value):
+        raise ValueError(f"{what} is not base64url")
+    pad = "=" * ((4 - len(value) % 4) % 4)
+    return base64.urlsafe_b64decode(value + pad)

oidc_caep_risc-0.1.0/src/oidc_caep_risc/backchannel.py

@@ -0,0 +1,79 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""The back channel. TLS is always verified; ca is added to the default trust store."""
+
+import http.client
+import socket
+import ssl
+from urllib.parse import urlsplit
+
+from .errors import OidcError
+
+MAX_BYTES = 2 * 1024 * 1024
+TIMEOUT_S = 15
+
+
+def _ssl_context(tls):
+    tls = tls or {}
+    context = ssl.create_default_context()
+    ca = tls.get("ca")
+    if ca:
+        context.load_verify_locations(cadata=ca)
+    cert = tls.get("cert")
+    key = tls.get("key")
+    if cert and key:
+        # load_cert_chain wants paths. PEM strings go through temporary files only if needed;
+        # SSLContext has no string API, so use a memory BIO via cadata is not for keys.
+        import os
+        import tempfile
+        cert_file = tempfile.NamedTemporaryFile("w", delete=False)
+        key_file = tempfile.NamedTemporaryFile("w", delete=False)
+        try:
+            cert_file.write(cert)
+            cert_file.close()
+            key_file.write(key)
+            key_file.close()
+            context.load_cert_chain(cert_file.name, key_file.name)
+        finally:
+            os.unlink(cert_file.name)
+            os.unlink(key_file.name)
+    return context
+
+
+def send(url, method="GET", headers=None, body=None, tls=None, code="protocol"):
+    """One HTTP(S) request. Redirects are not followed. The body is capped."""
+    parts = urlsplit(url)
+    if parts.scheme not in ("http", "https"):
+        raise OidcError(code, f"{url} is not an http(s) URL")
+    if not parts.hostname:
+        raise OidcError(code, f"{url} is not an http(s) URL")
+    port = parts.port or (443 if parts.scheme == "https" else 80)
+    path = parts.path or "/"
+    if parts.query:
+        path = f"{path}?{parts.query}"
+    payload = None if body is None else (body.encode("utf-8") if isinstance(body, str) else body)
+    hdrs = {str(k): str(v) for k, v in (headers or {}).items()}
+    if payload is not None:
+        hdrs["content-length"] = str(len(payload))
+    connection = None
+    try:
+        if parts.scheme == "https":
+            connection = http.client.HTTPSConnection(parts.hostname, port, timeout=TIMEOUT_S, context=_ssl_context(tls))
+        else:
+            connection = http.client.HTTPConnection(parts.hostname, port, timeout=TIMEOUT_S)
+        connection.request(method, path, body=payload, headers=hdrs)
+        response = connection.getresponse()
+        raw = response.read(MAX_BYTES + 1)
+        if len(raw) > MAX_BYTES:
+            raise OidcError(code, f"{url} answered more than {MAX_BYTES} bytes")
+        content_type = response.getheader("content-type") or ""
+        return {"status": response.status, "content_type": content_type, "body": raw.decode("utf-8", "replace")}
+    except OidcError:
+        raise
+    except socket.timeout as err:
+        raise OidcError(code, f"{url} did not answer within {TIMEOUT_S} s", cause=err) from err
+    except Exception as err:
+        raise OidcError(code, f"{url}: {err}", cause=err) from err
+    finally:
+        if connection is not None:
+            connection.close()

oidc_caep_risc-0.1.0/src/oidc_caep_risc/cli.py

@@ -0,0 +1,56 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Reads a configuration file and says whether it names a confidential client. It does not print secrets."""
+
+import sys
+
+from .config import read_config_file
+from .errors import OidcError
+
+
+def usage():
+    return """oidc-caep-risc — a confidential OpenID Connect client
+
+Usage
+  oidc-caep-risc check --config <file>   read the file and print the client, without its secret
+  oidc-caep-risc help
+
+The library is RelyingParty, imported from oidc_caep_risc."""
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    command = argv[0] if argv else "help"
+    if command in ("help", "--help", "-h"):
+        print(usage())
+        return 0
+    if command != "check":
+        print(f"unknown command {command}\n{usage()}", file=sys.stderr)
+        return 1
+    try:
+        at = argv.index("--config")
+    except ValueError:
+        at = -1
+    file = argv[at + 1] if at >= 0 and at + 1 < len(argv) else None
+    if not file:
+        print(f"check needs --config <file>\n{usage()}", file=sys.stderr)
+        return 1
+    try:
+        config = read_config_file(file)
+    except OidcError as err:
+        print(err, file=sys.stderr)
+        return 1
+    metadata = config.get("metadataUrl") or (config.get("metadata") or {}).get("issuer") or "(file)"
+    print(f"client_id:  {config['clientId']}")
+    print(f"auth:       {config['tokenEndpointAuthMethod']}")
+    print(f"redirect:   {config['redirectUri']}")
+    print(f"scopes:     {config['scopes']}")
+    print(f"metadata:   {metadata}")
+    print(f"secret:     {'present' if config.get('clientSecret') else 'absent'}")
+    print(f"tls ca:     {'present' if config.get('tlsCa') else 'absent'}")
+    print(f"ssf:        {(config.get('ssf') or {}).get('transmitter') or 'not configured'}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

oidc_caep_risc-0.1.0/src/oidc_caep_risc/client_auth.py

@@ -0,0 +1,59 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Client authentication on a token or pushed-authorization request."""
+
+import base64
+import json
+import time
+import uuid
+from urllib.parse import quote
+
+from .b64 import b64url_encode
+from .errors import OidcError
+from .keys import load_private_key, sign_jws
+
+
+def form_encode(value):
+    """application/x-www-form-urlencoded, the encoding of a Basic client id and secret (RFC 6749)."""
+    return quote(str(value), safe="-_.!~*'()").replace("%20", "+")
+
+
+def load_signing_key(pem, alg):
+    return load_private_key(pem, alg)
+
+
+def _compact(header, payload, key, alg):
+    signing_input = (
+        b64url_encode(json.dumps(header, separators=(",", ":")).encode("utf-8"))
+        + "."
+        + b64url_encode(json.dumps(payload, separators=(",", ":")).encode("utf-8"))
+    )
+    signature = sign_jws(key, alg, signing_input.encode("ascii"))
+    return signing_input + "." + b64url_encode(signature)
+
+
+def apply_client_auth(config, key, body, headers, audience):
+    """Adds this client's authentication. A client assertion's audience is the issuer."""
+    method = config["tokenEndpointAuthMethod"]
+    client_id = config["clientId"]
+    if method == "client_secret_basic":
+        raw = f"{form_encode(client_id)}:{form_encode(config.get('clientSecret') or '')}"
+        headers["authorization"] = "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+        return
+    if method == "client_secret_post":
+        body["client_id"] = client_id
+        body["client_secret"] = config.get("clientSecret") or ""
+        return
+    if key is None:
+        raise OidcError("config", "private_key_jwt has no signing key")
+    now = int(time.time())
+    alg = config.get("privateKeyAlg") or "RS256"
+    assertion = _compact(
+        {"alg": alg, "typ": "JWT"},
+        {"iss": client_id, "sub": client_id, "aud": audience, "jti": str(uuid.uuid4()), "iat": now, "exp": now + 60},
+        key,
+        alg,
+    )
+    body["client_id"] = client_id
+    body["client_assertion_type"] = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+    body["client_assertion"] = assertion