Implementation of OAuth2 authentication with HTTP Basic authentication scheme not RFC6749 compliant

Describe the bug

When authenticating to the keycloak oauth2 server with grant_type: "client_credentials" and the HTTP Basic authentication scheme as described in RFC6749 section 2.3.1 with url encoded special characters, keycloak rejects the authentication request with an 401 error response: { "error": "unauthorized_client", "error_description": "Invalid client secret" }

Version

16.1.1

Expected behavior

Keycloak should decode provided credentials in a basic authentication header before validating their correctness as specified in RFC6749 standard.

Actual behavior

Keycloak does not url decode the client credentials according to specification in basic authentication headers when authenticating an oauth2 client. Therefore requests of compliant clients with secrets containing special characters are not authenticated.

How to Reproduce?

When authenticating a client with client_id = "user" and client_secret = "secret/with=special?character", a compliant authentication request with basic auth header would look like this:

` POST /user-service/auth/realms/generic/protocol/openid-connect/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Authorization: Basic dXNlcjpzZWNyZXQlMkZ3aXRoJTNEc3BlY2lhbCUzRmNoYXJhY3Rlcg== User-Agent: PostmanRuntime/7.29.0 Accept: / Cache-Control: no-cache Host: keycloak-test.testdomain.de Accept-Encoding: gzip, deflate, br Connection: keep-alive

grant_type=client_credentials`

but gets denied with: ` HTTP/1.1 401 Unauthorized Cache-Control: no-store X-XSS-Protection: 1; mode=block Pragma: no-cache X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer Date: Mon, 09 May 2022 13:13:54 GMT X-Content-Type-Options: nosniff Content-Length: 75 Content-Type: application/json Strict-Transport-Security: max-age=31536000;includeSubDomains

{“error”:“unauthorized_client”,“error_description”:“Invalid client secret”}`

Anything else?

This issue has been brouht to our attantion through an update to the spring oauth2 client impementation: https://github.com/spring-projects/spring-security/issues/9610

[lexcao]

Hi, I create a PR to fix it. https://github.com/keycloak/keycloak/pull/12486

[lexcao]

Hi @mposolda @sschu Thanks for your confirmation. I am willing to follow up on this. I will create the issue and PR later.