Index: admin/tool/oauth2/classes/form/issuer.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- admin/tool/oauth2/classes/form/issuer.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ admin/tool/oauth2/classes/form/issuer.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -119,6 +119,10 @@
         $mform->addElement('checkbox', 'showonloginpage', get_string('issuershowonloginpage', 'tool_oauth2'));
         $mform->addHelpButton('showonloginpage', 'issuershowonloginpage', 'tool_oauth2');
 
+        // Use basic authentication.
+        $mform->addElement('checkbox', 'basicauth', get_string('usebasicauth', 'tool_oauth2'));
+        $mform->addHelpButton('basicauth', 'usebasicauth', 'tool_oauth2');
+
         $mform->addElement('hidden', 'sortorder');
         $mform->setType('sortorder', PARAM_INT);
 
Index: admin/tool/oauth2/lang/en/tool_oauth2.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- admin/tool/oauth2/lang/en/tool_oauth2.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ admin/tool/oauth2/lang/en/tool_oauth2.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -93,6 +93,8 @@
 $string['systemaccountconnected'] = 'System account connected';
 $string['systemaccountnotconnected'] = 'System account not connected';
 $string['systemauthstatus'] = 'System account connected';
+$string['usebasicauth'] = 'Authenticate token requests via HTTP headers';
+$string['usebasicauth_help'] = 'Utilize the HTTP Basic authentication scheme when sending client ID and password with a refresh token request. Recommended by the OAuth 2 standard, but may not be available with some issuers.';
 $string['userfieldexternalfield'] = 'External field name';
 $string['userfieldexternalfield_help'] = 'Name of the field provided by the external OAuth system.';
 $string['userfieldinternalfield_help'] = 'Name of the Moodle user field that should be mapped from the external field.';
Index: lib/classes/oauth2/client.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- lib/classes/oauth2/client.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ lib/classes/oauth2/client.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -71,6 +71,7 @@
         if (empty($returnurl)) {
             $returnurl = new moodle_url('/');
         }
+        $this->basicauth = $issuer->get('basicauth');
         parent::__construct($issuer->get('clientid'), $issuer->get('clientsecret'), $returnurl, $scopes);
     }
 
@@ -182,6 +183,12 @@
             'grant_type' => 'refresh_token'
         );
 
+        $headersbefore = $this->header;
+        if ($this->basicauth) {
+            $idsecret = "{$this->issuer->get('clientid')}:{$this->issuer->get('clientsecret')}";
+            $this->setHeader('Authorization: Basic ' . base64_encode($idsecret));
+        }
+
         // Requests can either use http GET or POST.
         if ($this->use_http_get()) {
             $response = $this->get($this->token_url(), $params);
@@ -189,6 +196,10 @@
             $response = $this->post($this->token_url(), $this->build_post_data($params));
         }
 
+        if ($this->basicauth) {
+            $this->header = $headersbefore;
+        }
+
         if ($this->info['http_code'] !== 200) {
             throw new moodle_exception('Could not upgrade oauth token');
         }
Index: lib/classes/oauth2/issuer.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- lib/classes/oauth2/issuer.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ lib/classes/oauth2/issuer.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -72,6 +72,10 @@
                 'type' => PARAM_BOOL,
                 'default' => false
             ),
+            'basicauth' => array(
+                'type' => PARAM_BOOL,
+                'default' => false
+            ),
             'scopessupported' => array(
                 'type' => PARAM_RAW,
                 'null' => NULL_ALLOWED,
Index: lib/db/install.xml
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- lib/db/install.xml	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ lib/db/install.xml	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -3500,6 +3500,7 @@
         <FIELD NAME="scopessupported" TYPE="text" NOTNULL="false" SEQUENCE="false" COMMENT="The list of scopes this service supports."/>
         <FIELD NAME="enabled" TYPE="int" LENGTH="2" NOTNULL="true" DEFAULT="1" SEQUENCE="false"/>
         <FIELD NAME="showonloginpage" TYPE="int" LENGTH="2" NOTNULL="true" DEFAULT="1" SEQUENCE="false"/>
+        <FIELD NAME="basicauth" TYPE="int" LENGTH="2" NOTNULL="true" DEFAULT="0" SEQUENCE="false" COMMENT="Use HTTP Basic authentication scheme when sending client ID and password"/>
         <FIELD NAME="sortorder" TYPE="int" LENGTH="10" NOTNULL="true" SEQUENCE="false" COMMENT="The defined sort order."/>
       </FIELDS>
       <KEYS>
Index: lib/db/upgrade.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- lib/db/upgrade.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ lib/db/upgrade.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -2932,5 +2932,20 @@
         upgrade_main_savepoint(true, 2017051501.09);
     }
 
+    if ($oldversion < 2017051501.101) {
+
+        // Define field basicauth to be added to oauth2_issuer.
+        $table = new xmldb_table('oauth2_issuer');
+        $field = new xmldb_field('basicauth', XMLDB_TYPE_INTEGER, '2', null, XMLDB_NOTNULL, null, '0', 'showonloginpage');
+
+        // Conditionally launch add field aggregationstatus.
+        if (!$dbman->field_exists($table, $field)) {
+            $dbman->add_field($table, $field);
+        }
+
+        // Main savepoint reached.
+        upgrade_main_savepoint(true, 2017051501.101);
+    }
+
     return true;
 }
Index: lib/oauthlib.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- lib/oauthlib.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ lib/oauthlib.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -399,6 +399,8 @@
     private $mocknextresponse = '';
     /** @var array $upgradedcodes list of upgraded codes in this request */
     private static $upgradedcodes = [];
+    /** @var bool basicauth */
+    protected $basicauth = false;
 
     /**
      * Returns the auth url for OAuth 2.0 request
@@ -544,6 +546,12 @@
             'redirect_uri' => $callbackurl->out(false),
         );
 
+        $headersbefore = $this->header;
+        if ($this->basicauth) {
+            $idsecret = "{$this->clientid}:{$this->clientsecret}";
+            $this->setHeader('Authorization: Basic ' . base64_encode($idsecret));
+        }
+
         // Requests can either use http GET or POST.
         if ($this->use_http_get()) {
             $response = $this->get($this->token_url(), $params);
@@ -551,6 +559,10 @@
             $response = $this->post($this->token_url(), $this->build_post_data($params));
         }
 
+        if ($this->basicauth) {
+            $this->header = $headersbefore;
+        }
+
         if ($this->info['http_code'] !== 200) {
             throw new moodle_exception('Could not upgrade oauth token');
         }
Index: version.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- version.php	(revision af129014b1943fca6c5aed5971bc838e5b2c43a6)
+++ version.php	(revision 0487fe02348305f4af785da66ecbcbb8f556e1db)
@@ -29,7 +29,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2017051501.10;              // 20170515      = branching date YYYYMMDD - do not modify!
+$version  = 2017051501.101;              // 20170515      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.