docs: Document OIDC clientAuthenticationMethod and use it in test

Author: dervoeti

docs/modules/druid/examples/druid-oidc-authentication.yaml

@@ -22,6 +22,9 @@ spec:
       - authenticationClass: oidc-auth
         oidc:
           clientCredentialsSecret: druid-oidc-client
+          # Optional: Override the client authentication method (default: client_secret_basic).
+          # Supported values: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, none.
+          clientAuthenticationMethod: client_secret_basic
   [...]
 # end::druid[]
 

docs/modules/druid/pages/usage-guide/security.adoc

@@ -102,8 +102,13 @@ The secret containing the OIDC client credentials should be structured like this
 include::example$druid-oidc-authentication.yaml[tag=secret]
 ----
 
-NOTE: OIDC authentication may fail since Druid versions `35.x.x` and `36.x.x` due to a change in how the authentication method is selected when connecting to an OIDC provider.
-If your OIDC provider (e.g. Keycloak) advertises `private_key_jwt` as a supported client authentication method, Druid may attempt to use it, which causes authentication to fail.
+==== Client authentication method
+
+The `clientAuthenticationMethod` field controls which method Druid uses when authenticating with the OIDC provider's token endpoint.
+Supported values are `client_secret_basic` (default), `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, and `none`.
+
+NOTE: Since Druid versions `35.x.x` and `36.x.x`, the underlying pac4j library may auto-detect `private_key_jwt` from the OIDC provider's discovery document, causing authentication to fail.
+If you encounter this, set `clientAuthenticationMethod` explicitly to `client_secret_post` (or whichever method your provider expects).
 
 === Current Limitations and Upcoming Work
 

tests/templates/kuttl/oidc/40_druid.yaml.j2

@@ -37,6 +37,7 @@ spec:
     - authenticationClass: druid-oidc-auth-class-$NAMESPACE
       oidc:
         clientCredentialsSecret: druid-oidc-client
+        clientAuthenticationMethod: client_secret_post
     deepStorage:
       s3:
         bucket: