Description

IdentityAssertionOAuthProvider._build_token_request() in
src/mcp/client/auth/extensions/identity_assertion.py has the same issue as #3138
(fixed for the main OAuthContext.prepare_token_auth()), in its own independent
implementation: client_id is unconditionally placed in the request body, and is
never removed when token_endpoint_auth_method == "client_secret_basic" — even
though it's already presented via the Authorization: Basic header at that point.

RFC 6749 §2.3 requires that with Basic auth, client credentials not also appear in
the body. Strict token endpoints (Keycloak, Okta in strict mode) reject a request
that presents credentials both ways.

Where

# src/mcp/client/auth/extensions/identity_assertion.py, _build_token_request()
data: dict[str, str] = {
    "grant_type": JWT_BEARER_GRANT_TYPE,
    "assertion": assertion,
    "client_id": self._client.client_id,  # <-- always present, never stripped
    "resource": self._resource,
}
...
if self._client.token_endpoint_auth_method == "client_secret_basic":
    ...
    headers["Authorization"] = f"Basic {credentials}"
    # client_id above is never removed from `data`
else:
    data["client_secret"] = self._client.client_secret

Proposed fix

Move client_id into the else (client_secret_post) branch alongside
client_secret, so it's only added to the body for the post method — matching the
fix already applied to OAuthContext.prepare_token_auth for #3138.

I have a fix + tests ready and would like to submit a PR (disclosed: drafted with
AI assistance, reviewed and understood by me).