How to deactivate or disable Client Id and Client Secret for basic authentication?

[danfqa]

Hello experts, could you kindly lend me a hand with this inquiry? When a service key is generated in BTP (Cloud Foundry) for incoming client authentication, it produces an OAuth 2.0. The Client Id and Client Secret can be employed for basic authentication. Is there a method to disable this functionality, in essence, rendering both the Client Id and Client Secret unusable as Username and Password? I have some concerns, particularly in a production tenant. Thank you very much for your assistance, corrections, and any additional insights!

Daniel Quintero.

[Sriprasadsbhat]

Hello Daniel,

As per my understanding its not possible to restrict ClientId/ClientSecret for basic authentication usage.

Regards,

Sriprasad S Bhat

[danfqa]

Thank you very much for the prompt response, Sriprasad Shivaram Bhat! As I see it, SAP doesn't recommend this option for production scenarios. So, should a certificate be used instead? What I find intriguing is that the Client Id and Client Secret used for basic authentication are the same as those used to consume the token.

[VijayKonam]

As far as I remember, when you create the key with both client_credentials and password type, it could be used as basic auth creds. If the key is created with on client_credentials usage, one cannot use it for basic authentication. Did that behavior change?

[danfqa]

Hello Vijay Konam, I'm sharing these images with you... Thanks!