[Client] Support JWT for Client Authentication, as defined in RFC 7523

Expected Behavior

I would like to be able to use an externally signed JWT for Client Authentication (as defined in RFC 7523).

The developer should be able to configure the JWT as a String or path to a file.

Current Behavior

The current OAuth2 Client has full support for the OIDC Client Authentication specification (https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). In this context, this namely includes private_key_jwt and client_secret_jwt. However, these are built on top of RFC 7523 and this does not support providing a custom JWT for client_assertion.

Context

• Keycloak has a feature called "Federated Client Authentication" that allows a client to use JWTs (e.g. Kubernetes ServiceAccount Tokens) as a credential (https://www.keycloak.org/2026/01/federated-client-authentication).
  • This does not follow OIDC specification, but merely supports what is defined in RFC 7521, or more precisely RFC 7523.

Related to https://github.com/spring-projects/spring-security/issues/8175

Start by reviewing the OAuth2 Client authentication implementation and the RFC 7523 and OpenID Connect Client Authentication references linked in the issue. The work is done when a developer can configure an externally signed JWT as a String or file path for the client_assertion, with appropriate tests covering both forms.