[Filebeat][xpack][httpjson] - OAuth2 use without client secret and with url params is not possible

[p-leh]

Describe the enhancement:

1. The option is missing that the credentials going to be passed as header params as well or even better to use the automatic function from the oauth2 package. (oauth2 package - golang.org/x/oauth2 - Go Packages)

x-pack->filebeat->input->httpjson->config_auth.go
LINE 25:

// authStyleInParams sends the "client_id" and "client_secret" in the POST body as application/x-www-form-urlencoded parameters.
const authStyleInParams = 1

Change to Auto Detection

// authStyleAutoDetect sets the autodetection either the client credentials are send as BODY params or HEADER params
const authStyleAutoDetect = 0

2. The passing of the required client credentials is to strict, because the param validator checks the client secret as well. But the client secret can be empty too and even still valid for oauth2 access process.

x-pack->filebeat->input->httpjson->config_auth.go
LINE 216:
Exclude client secret from validator [ o.ClientSecret == "" ] and adjust error message

	case oAuth2ProviderDefault:
		if o.TokenURL == "" || o.ClientID == "" { 
			return errors.New("both token_url and client.id credentials must be provided")
		}
		if (o.User != "" && o.Password == "") || (o.User == "" && o.Password != "") {
			return errors.New("both user and password credentials must be provided")
		}
...

Describe a specific use case for the enhancement or feature:

We have an oauth2 service which supports passing the parameter by header only and not by params in the body.
Furthermore the required credentials for the client contains a id and an empty secret.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[belimawr]

@elastic/security-external-integrations this is a enhancement request for the HTTP JOSN Input, I believe it belongs to you, is that right?

We had a small discussion about it on Discuss: https://discuss.elastic.co/t/filebeat-xpack-httpjson-oauth2-use-without-client-secret-and-with-url-params-is-not-possible/314691.

My understanding is that @p-leh will give a shot at implementing it.