Begin of the deletion ### Steps to reproduce

1.End of the deletion As an administrator, Begin of the insertion
I want to have PKCE support inEnd of the insertion Begin of the deletion configure a customEnd of the deletion OpenID Begin of the insertionConnect,
soEnd of the insertion Begin of the deletion Connect provider (Enterprise) against an IdPEnd of the deletion that Begin of the insertionI can connectEnd of the insertion Begin of the deletion mandates PKCE (RFC 7636) — e.g. EU Login / ECAS, issuer `https://ecas.acceptance.ec.europa.eu/cas/oauth2`, authorization-code flow, confidential client (`client_secret_basic`).
2. As an end user, start login: open `GET /auth/oidc`.
3. Inspect the 302 redirectEnd of the deletion to Begin of the insertionidentity providers that enforceEnd of the insertion the Begin of the insertionusage ofEnd of the insertion Begin of the deletion IdP `authorize` endpoint — examine its query string.
4. Authenticate at the IdP and observe the callback.

### What is the buggy behavior?

- The authorization request query string contains only `client_id`, `nonce`, `redirect_uri`, `response_type`, `scope`, `state` — **no `code_challenge` / `code_challenge_method`**.
- The IdP redirects to the callback with `error=invalid_request` and `error_description=Invalid request: Missing CodeChallenge (PKCE - RFC 7636)`. Login never completes.
- There is no env var and no Admin-UI field to enableEnd of the deletion PKCE.

### Begin of the insertion

###

### Acceptance criteriaEnd of the insertion Begin of the deletion What is the expected behavior?End of the deletion

Begin of the insertion* End of the insertion Begin of the deletion -End of the deletion OpenProject Begin of the insertionsupportsEnd of the insertion Begin of the deletion should send aEnd of the deletion PKCE Begin of the deletion `code_challenge` (S256) on the authorization requestEnd of the deletion when Begin of the insertionauthenticating through OpenID Connect


End of the insertion Begin of the deletion configured to, so login succeeds against PKCE-mandatory IdPs — exposed both as an env var (`OPENPROJECT_OPENID__CONNECT_<provider>_PKCE`) and an Admin-UI toggle.

End of the deletion ### Begin of the insertionTechnical notesEnd of the insertion Begin of the deletion Root cause / proposed fixEnd of the deletion

Begin of the insertion* DependsEnd of the insertion Begin of the deletion - `omniauth-openid-connect` is pinned at 0.5.0End of the deletion on Begin of the insertionan upgrade ofEnd of the insertion Begin of the deletion `omniauth` 1.9.2 (opf forks); PKCE landed at gem 0.6.0. The provider model (`modules/openid_connect/app/models/openid_connect/provider.rb`) has no `pkce`/`code_challenge` attribute. Fix: addEnd of the deletion the Begin of the insertionunderlying `omniauth-openid-connect`End of the insertion Begin of the deletion option and bump theEnd of the deletion gem Begin of the insertion

* either by updating OP&#39;s fork of it

* ... or by getting rid ofEnd of the insertion Begin of the deletion (needs a newer omniauth thanEnd of the deletion the Begin of the insertionfork


### References

* [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636)


### Additional notes

End of the insertion Begin of the deletion forked 1.9.2). Verified unchanged on 17.4.0 and `dev`.End of the deletion Contributor offer: happy to test a build against the EU Login/ECAS acceptance IdP. Begin of the deletion

### Logs

```
# IdP callback (browser network tab):
error=invalid_request
error_description=Invalid request: Missing CodeChallenge (PKCE - RFC 7636)
iss=https://ecas.acceptance.ec.europa.eu/cas/oauth2
# Authorize redirect query string has no code_challenge / code_challenge_method.
```
Attach: screenshot of the callback error.

### Environment information

**OpenProject installation type**
- [x] Other (please specify): **Kubernetes — official OpenProject Helm chart (opf/helm-charts 13.5.1), deployed via ArgoCD on EC DIGIT CaaS (private cloud)**

**OpenProject version**
v17.3.1 (chart 13.5.1). Re-verified still present on v17.4.0 / chart 13.6.0.

**Browser**
- [x] Other (please specify): **N/A — server-side / IdP redirect**

**Operating System**
- [x] Linux (please specify distro): **Debian (OpenProject slim container base), on Kubernetes**

**Language**
Browser English (en); OpenProject user language English.
End of the deletion