Spotfire Server: OpenID fails with "the call to the PAR endpoint failed"

When using OpenID Connect for authentication, the following error may be seen if the provider implements a PAR (Pushed Authentication Request) endpoint. 

The call to the PAR endpoint failed, falling back to not using PAR

com.spotfire.server.security.auth.oidc.TokenEndpointOAuth2ClientException:
Error calling the Pushed Authorization Request Endpoint:
client authentication failed invalid_request,
error_description: Cannot supply multiple client credentials.

Use one of the following:
- credentials in the Authorization header
- credentials in the post body
- a client_assertion in the post body.

This issue has been seen when using OKTA as the provider, but may be present with other OpenID providers also. 

This is a known defect in Spotfire Server. The issue is caused by the server sending a client ID in both the POST payload and the authentication header to the PAR endpoint, which causes the provider to reject the request with a 401 Unauthorised error. 

Note that this issue is not fatal. Users will still be able to authenticate,  however Spotfire will fall back to not using PAR for authentication. 

The solution is to change the token endpoint authentication method to client_secret_post, the default in Spotfire is to use client_secret_basic. 

This can be done as follows. 

1. Export the Spotfire server configuration:
    

   config.bat export-config -f




2. Alter the token endpoint authentication method:

   
   

   config.bat  config-oidc  -c configuration.xml  --set-provider
     -n <NAME OF PROVIDER>  --provider-discovery-url <DISCOVERY URL>
     --provider-client-id <CLIENT ID> --provider-client-secret <CLIENT SECRET>
     --provider-token-endpoint-auth-method client_secret_post




3. Import the updated configuration:

   
   

   config.bat import-config -c "Updated token endpoint authentication"



4. Restart the Spotfire service.

After making these changes, the error should disappear.