Edit forms do not properly hide sensitive values

Security team note: The Drupal Security Team has been informed of this issue and approved that it be fixed publicly.

Summary

The 3.x branch of the module has an information disclosure issue: when a config override (for example, from settings.php) is applied to a sensitive client value such as the client secret, the overridden value is displayed in plain text in the client edit form. If the form is then saved, that overridden value is written to the database, potentially persisting a secret that was only intended to exist in a local, non-committed override.

Steps to reproduce

1. Install 3.0.7-alpha7 (any 3.x version is affected; 3.x is the only branch compatible with Drupal 11).
2. Create a new client at admin/config/people/openid-connect/add/azure_ad with the following values:
   • Name: Test
   • Client ID: client id
   • Client Secret: client secret
   • Tenant: tenant
3. Add a config override for the client secret in settings.php:
   

   $config['openid_connect.client.test']['settings']['client_secret'] = 'overridden client secret';

4. Visit admin/config/people/openid-connect/test/edit. The Client Secret field displays overridden client secret. Saving the form persists that value to the database.

Note: Azure AD is used as an example; all client plugins bundled with the module are affected.

Root cause

In OpenIDConnectClientEntity (src/Entity/OpenIDConnectClientEntity.php:136), configuration is read via ConfigFactory::get() instead of ConfigFactory::getEditable(). The fix is not a straightforward method swap, because the overridden value needs to be used outside the form context; the scope of $this->configuration is contextual.

Suggested approach

The Microsoft Azure Active Directory client already solves this by integrating with the Key module for config overrides of sensitive values. See: https://git.drupalcode.org/project/openid_connect_windows_aad/-/blob/2.0.x/src/Plugin/OpenIDConnectClient/WindowsAad.php?ref_type=heads#L237-241