feat(oidc): client authentication modes (#5150)

This adds a feature to OpenID Connect 1.0 where clients can be restricted to a specific client authentication mode, as well as implements some backend requirements for the private_key_jwt client authentication mode (and potentially the tls_client_auth / self_signed_tls_client_auth client authentication modes). It also adds some improvements to configuration defaults and validations which will for now be warnings but likely be made into errors.

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>

1 files changed, 14 insertions, 0 deletions

diff --git a/internal/configuration/validator/keys_test.go b/internal/configuration/validator/keys_test.go
index 989b4b815..a5123ef8c 100644
--- a/internal/configuration/validator/keys_test.go
+++ b/internal/configuration/validator/keys_test.go
@@ -101,6 +101,20 @@ func TestSpecificErrorKeys(t *testing.T) {
 	assert.EqualError(t, errs[4], specificErrorKeys["authentication_backend.file.hashing.algorithm"])
 }
 
+func TestPatternKeys(t *testing.T) {
+	configKeys := []string{
+		"server.endpoints.authz.xx.implementation",
+		"server.endpoints.authz.x.implementation",
+	}
+
+	val := schema.NewStructValidator()
+	ValidateKeys(configKeys, "AUTHELIA_", val)
+
+	errs := val.Errors()
+
+	require.Len(t, errs, 0)
+}
+
 func TestReplacedErrors(t *testing.T) {
 	configKeys := []string{
 		"authentication_backend.ldap.skip_verify",