authelia: OIDC: public client - "Client authentication failed [...]. The requested OAuth 2.0 Client does not exist."

Bug Report

Description

I’m using Authelia as my OIDC identity provider for ownCloud Infinite Scale (oCIS). oCIS is a public client, so my Authelia configuration looks like this:

 ...
    clients: 
      - id: owncloud
        description: ownCloud
        public: true
        secret: ''
        authorization_policy: one_factor
        audience:
          - user:mypersonaluser
        redirect_uris:
          - https://cloud.mydomain.tld/index.php/apps/openidconnect/redirect
          - https://cloud.mydomain.tld/oidc-callback.html
          # ! when OpenID Connect Front-Channel Logout 1.0 is implemented
          # - https://cloud.mydomain.tld/index.php/apps/openidconnect/logout
        scopes:
          - openid
          - email
          - profile

On login, I am directed to Authelia, but I’m getting a HTTP 401 response code:

{
  "error" : "invalid_client",
  "error_description" : "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The requested OAuth 2.0 Client does not exist."
}

and this log output:

Error occurred in NewAuthorizeRequest: invalid_client
github.com/ory/x/errorsx.WithStack
    github.com/ory/x@v0.0.250/errorsx/errors.go:38
github.com/ory/fosite.(*Fosite).NewAuthorizeRequest
    github.com/ory/fosite@v0.40.2/authorize_request_handler.go:288
github.com/authelia/authelia/v4/internal/handlers.oidcAuthorization
    github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:21
github.com/authelia/authelia/v4/internal/middlewares.NewHTTPToAutheliaHandlerAdaptor.func1
    github.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:113
github.com/authelia/authelia/v4/internal/middlewares.AutheliaMiddleware.func1.1
    github.com/authelia/authelia/v4/internal/middlewares/authelia_context.go:51
github.com/fasthttp/router.(*Router).Handler
    github.com/fasthttp/router@v1.4.1/router.go:414
github.com/authelia/authelia/v4/internal/middlewares.LogRequestMiddleware.func1
    github.com/authelia/authelia/v4/internal/middlewares/log_request.go:14
github.com/valyala/fasthttp.(*Server).serveConn
    github.com/valyala/fasthttp@v1.28.0/server.go:2239
github.com/valyala/fasthttp.(*workerPool).workerFunc
    github.com/valyala/fasthttp@v1.28.0/workerpool.go:223
github.com/valyala/fasthttp.(*workerPool).getCh.func1
    github.com/valyala/fasthttp@v1.28.0/workerpool.go:195
runtime.goexit
    runtime/asm_amd64.s:1371" stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:23          oidcAuthorization
github.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:113 NewHTTPToAutheliaHandlerAdaptorfunc1
github.com/authelia/authelia/v4/internal/middlewares/authelia_context.go:51                  AutheliaMiddleware.func1.1
github.com/fasthttp/router@v1.4.1/router.go:414                                              (*Router).Handler
github.com/authelia/authelia/v4/internal/middlewares/log_request.go:14                       LogRequestMiddleware.func1
github.com/valyala/fasthttp@v1.28.0/server.go:2239                                           (*Server).serveConn
github.com/valyala/fasthttp@v1.28.0/workerpool.go:223                                        (*workerPool).workerFunc
github.com/valyala/fasthttp@v1.28.0/workerpool.go:195                                        (*workerPool).getCh.func1
runtime/asm_amd64.s:1371                                                                     goexit"

I looked more than twice at my ownCloud configuration. The client_id matches, and I don’t know what’s wrong ATM. The request URI looks like this:

https://auth.mydomain.tld/api/oidc/authorize?client_id=owncloud&redirect_uri=https://cloud.mydomain.tld/oidc-callback.html&response_type=code&scope=openid email profile&state=3902f8bfaf274d46925253fbb4854618&code_challenge=Z7UiTOYqCoTCM6vtuhcAVjDpXEyv95L0HxRZUmdxR10&code_challenge_method=S256&response_mode=query

As I’m running Authelia in K8s, I have restarted the pod several times (deleting it and letting the replica-set do its work), I have checked that all ConfigMaps are up-to-date, etc.

Expected Behaviour

I should be able to see Authelia’s log-in screen and log in.

Reproduction Steps

I’m not sure whether this has to do with the public client type or not. For additional information have a look at owncloud/ocis#2445.

Additional Information

Versions

Authelia: 4.30.4 oCIS: 1.11.0 (Technical Preview) HTTP/3 was used for all requests (not sure if this was relevant).

The documentation on OIDC states that beta2 was not implemented as of yet, but version 4.30.X is already released. There is some confusion about this as well…