Remove mention of protected resource

[MartinFlores751]

Following lines in question:

irods_client_http_api/README.md

Lines 270 to 272 in 486c1b1

	// The client secret used for accessing the introspection endpoint.
	// Optional unless running as a protected resource.
	"client_secret": "xxxxxxxxxxxxxxx",

Just remove the second line make it clear it's only used in introspection mode, not local validation mode.

[MartinFlores751]

Looking at the code using client_secret, we may be able to remove client_secret from the required portion of the schema:

irods_client_http_api/core/src/main.cpp

Lines 273 to 282 in 486c1b1

	"required": [
	"timeout_in_seconds",
	"state_timeout_in_seconds",
	"provider_url",
	"client_id",
	"require_aud_member_from_introspection_endpoint",
	"user_mapping",
	"client_secret",
	"access_token_validation_method"
	]

client_secret should only be required when access_token_validation_method is set to introspection.

[trel]

yes, we go back and forth on whether things should be required (for consistency and documentation) in our schemas or truly optional.

@korydraughn we should probably get our thoughts/policy/plan written down somewhere so we can reference them later (and now!).

[korydraughn]

We should update the schema to enforce the valid cases. If we can do that at the schema level or as a post validation step and stop the server from starting, then the server enforces our intent perfectly. That doesn't protect the server from runtime problems stemming from poor config values.

That said, I think we should record our policy in a separate file e.g. DEVELOPERS.md. That kind of thing feels like it shouldn't be put in the README.

Thoughts?

[trel]

it's not just for this repo though... feels like we should get it into irods_docs proper...

[korydraughn]

Oh. I thought you were referring to this specific repo.

Can see what that looks like in irods_docs.