The client MUST NOT use more than one authentication method in each

[lellomaverick]

Hello everyone, I am using a private Identity Access Manager and I am able to complete the login process until I return to my application. This is the simple code:

$oidc = new OpenIDConnectClient( 'https://aaa.it/oauth2/token', 'xxx', 'yyy' ); $oidc->addScope('profile'); $oidc->addScope('email'); $oidc->addScope('api'); $oidc->setCodeChallengeMethod('S256');

$oidc->authenticate();

After logging into IAM, I go back to my application and I have in GET code, state, session_state. Using the same code as before I get this message: The client MUST NOT use more than one authentication method in each. The requestTokens function returns this error to me.

What can I do to solve the problem?

[marzoli]

The problem is in the requestTokens method where if is set 'code_verifier' it is also set 'client_id' but the variable $authorizationHeader is not unset correctly. Please fix it.