Goal

• As an admin I want to be able to use a certificate with matching private key to authenticate the IdP client used for Device Authorization instead of secret/password, so that I can leverage well defined certificate practices such as rotation, expiry, etc.

Acceptance criteria

A list of verification conditions, successful functional tests, or expected outcomes in order to declare this story/task successfully completed.

• Verify configuration can be set to use a certificate
• Verify authentication can be done using that certificate

Entra ID and other external IdPs support using TLS certificates for OAuth2 client authentication. The goal is to support using TLS certificate in oidc_child. There is an RFC 8705 for mTLS authentication in OAuth2 framework. I have not verified yet whether this is exact functionality supported by the Entra ID.