I'm new with using OAuth2 and want to use it to allow endpoint users to be authenticated with their accounts using LDAP. While the authentication process works, I see that you must send the client ID and client Secret of the app with every request token.
From what I can guess, it is a terrible idea to store the client ID and Secret in the client-level app. The way I thought of going about it is to make a small "authentication service" that will receive the user's data (LDAP Username & Password or other methods in the future), and return the OAuth2 token. That service will have access to the client ID and Secret that will be stored securely.
Is this the right approach for this and does this apply the best practices with Oauth2? Or is there a better way to authenticate end users without them having access to the client secret at client side?