We have set up IWA for our on premise ArcGIS Enterprise. I'd like to share the web map with secured services to Public (everyone). Is there a way to set up using any one of Oauth methodologies in Javascript to access this ?
https://developers.arcgis.com/documentation/security-and-authentication/app-authentication/
You should be able to do this using App Authentication. This page should outline how it works and links to a tutorial.
Do we need to set up a web server application to pass these client Id and secret between portal and web server application?
To maintain security, your application will need a server side to generate a token. If you place the client id directly in the client side code, anyone could extract the id from the javascript code and access your data in another application. Tokens prevent this by only being useful for a limited time and from the requested IP.