OIDC client support for using JWTs as Authorization Grants

[sberyozkin]

Fixes #40905.

This PR builds on the work started by @argenstijn and makes it possible to send OIDC client JWT authentication token as a JWT bearer grant assertion to support a Salesforce integration.

OIDC client must always authenticate to the OIDC server in order to complete a token grant exchange. There could be many types of grants, and many types of the OIDC client authentication. For example, OIDC client can start a client credentials grant token exchange and provide a client id and secret to authenticate. In fact, a client credentials grant can be supported instead by a client JWT authentication options.

In the Salesforce case, the client JWT authentication token plays the role of the JWT bearer grant assertion value. Essentially it is like a client credentials grant, but instead of setting the grant_type to client_credentials and supplying the JWT authentication token as client assertion authentication parameters, Salesforce expects a JWT bearer grant type whose value is the same authentication token expressed as an assertion property.

The PR is very simple, it adds an assertion boolean property to the JWT authentication group (instead of originally suggested grant) and if it is set, OIDC client passes it as an assertion form property if the correct JWT bearer grant is configured by the user. Test is added to confirm it works as expected

[sberyozkin]

Just updated the error message a bit. The reason I think it is correct to enforce that the users set the correct JWT grant themselves is that, if the users wants in fact to use another grant, then sending an assertion alongside client_credentials , etc, would make no sense

[sberyozkin]

Note, as far as JWT bearer grant is concerned, it is already supported at the OIDC token propagation/exchange level but where the assertion is already supplied dynamically.

[sberyozkin]

Thanks @gastaldi, I'll keep it open till Monday evening in case Pedro might want to have a look too.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit e6e18b4.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.