OIDC configuration issue with Client Secret

[Hera39]

Hello, I have an issue concerning the OIDC configuration for deptrack. When I check the documentation I can't find where am I supposed to set the client secret ; In my case I need to set the client secret in deptrack config so that the dialogue betwwen deptrack and my issuer works.
Can anyone help please?
thanks in advance

[nscuro]

Dependency-Track is a public client, meaning that if a secret was configurable, it would be leaked, thus making it pointless.

[EHEX-schildt]

Hi
i would like to understand why dependency-track uses OIDC Public client instead of a confidential client.

I see no Problem in keeping the client secret next to ALPINE_OIDC_CLIENT_ID.

In case of LDAP: ALPINE_LDAP_BIND_USERNAME and ALPINE_LDAP_BIND_PASSWORD are both configured in the apiserver.
Why is the ALPINE_LDAP_BIND_PASSWORD safe and a oidc secret not?

[mendorf]

I just guess LDAP is a completely different protocol than HTTPS.
Another guess, DT frontend is a single page application (SPA). For ADFS 2019 as an example, Microsoft put up some documentation showing that any secret configured would be part of the request URI (afaik visible on the network, regardless if HTTP or HTTPS is used).