title: How can I force Keycloak to use an Authorization header when connecting to an identity provider's token endpoint?
body: <p>I've configured Keycloak as an identity broker, connecting to a custom OIDC provider that I've created.  During the authorization_code flow, Keycloak calls the authorization endpoint to get the code.  It then calls the token endpoint of my custom OIDC provider to exchange the code for an auth token.</p>
  
  <p>I observe that Keycloak passes the client_id and client_secret as parameters in the request body, instead of as a Basic Authorization header.  I do not want to change the security configuration on my token endpoint.  Is there a way to cause Keycloak to send token requests to IdPs using the Auth header?</p>
  
  <p>Relevant Keycloak code appears to be in <code>AbstractOAuth2IdentityProvider</code>'s <code>generateTokenRequest</code> method.  This hard-codes the client-id and client-secret to be passed as params in the request body.</p>
  
  <p>According to the OIDC specification, <code>client_secret_basic</code> is the default.  I'd be surprised if this is not supported by Keycloak; I just can't seem to figure out how to configure it.</p>