feat(oauth2): add client credentials flow with opt-in config flag

[matzegebbe]

Overview

Add OAuth2 client_credentials grant type support, gated behind an opt-in clientCredentialsEnabled config flag.

What this PR does / why we need it

Dex has no built-in support for the client_credentials grant, which is the standard OAuth2 flow (RFC 6749 Section 4.4) for service-to-service authentication where no end-user is involved. This has been a long-standing community request.

This PR implements the grant and gates it behind a new clientCredentialsEnabled config flag that defaults to false, following the same pattern used by passwordConnector for the password grant. This ensures no behavior change for existing deployments.

Grant behavior:

• Requires a confidential client (public clients are rejected)
• Authenticates via client ID + secret (HTTP Basic auth)
• Supports openid, email, profile, groups scopes
• Returns an ID token when openid scope is requested
• Rejects offline_access and federated:id scopes (no refresh tokens for M2M)
• Claims are derived from the client itself: aud = client ID, sub = encoded client ID + connector ID, name/preferred_username = client name (with profile scope)

Configuration:

oauth2:
  clientCredentialsEnabled: true

Security considerations:

• Opt-in only: the grant is never exposed unless explicitly enabled
• Confidential clients only: public clients cannot use this grant
• No refresh tokens: offline_access scope is rejected, limiting token lifetime
• Service identity: the sub claim is the client ID, not a user

Testing:

• go build ./... compiles cleanly
• go test ./server/... -run TestHandleClientCredentials — 7 cases pass
• go test ./server/... -run TestServerSupportedGrants — 6 cases pass
• go test ./server/... -run TestHandleDiscovery — passes
• go test ./server/... — full server suite passes
• Manual test: start dex with clientCredentialsEnabled: true, request token via curl

Manual verification:

1. Enable the flag in examples/config-dev.yaml:

oauth2:
  clientCredentialsEnabled: true

2. Build and run dex:

go run ./cmd/dex serve examples/config-dev.yaml

3. Request an access token:

curl -X POST http://127.0.0.1:5556/dex/token \
  -u "example-app:ZXhhbXBsZS1hcHAtc2VjcmV0" \
  -d "grant_type=client_credentials"

4. Request an access token + ID token:

curl -X POST http://127.0.0.1:5556/dex/token \
  -u "example-app:ZXhhbXBsZS1hcHAtc2VjcmV0" \
  -d "grant_type=client_credentials&scope=openid+profile"

Closes #3660

The gating mechanism works the same way as the password grant: client_credentials is included in the default allowed grant types list, but only gets added to allSupportedGrants (and thus passes the intersection filter in newServer()) when ClientCredentialsEnabled is true. Without the flag, the grant type is silently filtered out.

[nabokihms]

Hello! There are some points to resolve before merging.

[nabokihms]

@sagikazarmark, since the feature is opt-in and not enabled by default, I see no problem merging this. If you have no objections, I will merge the PR.

@matzegebbe thank you for the PR.