Implementing Oauth2 for User Enrollment

** Hi Community,**

We have been testing on using oauth2 for User Enrollment.Where as per doc provided we have supplied the method, authorization-url, token-url, redirect-url, client-id in the 401 response from MDM Server

Authorization Request

As mentioned the apple client performed authorization request by adding state, login_hint to the Authorization-url and the params mentioned above and successfully received the authorization code after the user makes a login with the IDP.

<<<<< Request
GET /oauth2/authorization?response_type=code
    &client_id=XXXXXXXXXX
    &redirect_uri=apple-remotemanagement-user-login:/oauth2/redirection
    &state=XXXXXXXXXX
    &login_hint=useroa@example.com HTTP/1.1
Host: mdmserver.example.com

------- MULTIPLE REQUESTS BETWEEN CLIENT Server ----------

>>>>> Response
HTTP/1.1 308 Permanent Redirect
Content-Length: 0
Location: apple-remotemanagement-user-login:/oauth2/redirection
    ?code=XXXXXXXXXX&state=XXXXXXXXXX

.

Token Request

Using the code received from authorization server apple client performs this step to get the access_token and refresh_token.I am using a authorization server created by default in my Okta domain and this step fails.

<<<<< Request
POST /oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

grant_type=authorization_code
    &code=XXXXXXXXXXXX
    &redirect_uri=apple-remotemanagement-user-login:/oauth2/redirection
    &client_id=XXXXXXXXXX


>>>>> Response
HTTP/2 401 Unauthorized
Content-Type: application/json
{
  "error": "invalid_client",
  "error_description": "Client authentication failed. Either the client or the client credentials are invalid."
}

When debugged this issue, As per Okta's doc https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/#exchange-the-code-for-tokens The client must specify Their credentials in Authorization header as Authorization : Basic <client_id>:<client_secret> in order to get the access_token

And Also as per RFC-6749 https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3 The Confidential Clients must specify their client_id, client_secret provided by the authorization server to receive the access_tokens.

May I know how to overcome this issue or did I missed any steps that may include the Authorization header

Thanks in Advance,.