ClientCredentialsGrant cannot use method client_secret_post
See original GitHub issueCannot use client_credentials and POST client secrets in to he request body. The ClientCredentialsGrant.validate_token_request()
uses BaseGrant.authenticate_token_endpoint_client()
which:
- doc says Default available methods are: “none”, “client_secret_basic” and “client_secret_post”.
- But the code uses
self.TOKEN_ENDPOINT_AUTH_METHODS
which is only['client_secret_basic']
Note: the DB oauth2_client.token_enpoint_auth_method
is ignored.
Issue Analytics
- State:
- Created 5 years ago
- Comments:6 (3 by maintainers)
Top Results From Across the Web
OAuth 2.0 Client Credentials Grant Flow - ForgeRock Backstage
The Client Credentials grant is used when the client is also the resource owner and it is accessing its own data instead of...
Read more >Client Credentials Grant - OpenId Connect
The OpenId Connect Client Credentials grant can be used for machine to machine authentication. In this grant a specific user is not authorized...
Read more >Client Credentials Flow - Cloudentity
Client credentials grant is a flow used for communication between single ... Set token endpoint authentication method to Client secret post.
Read more >OAuth 2.0 client credentials flow on the Microsoft identity ...
The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a ...
Read more >Generate token in WebApi. Error: "Grant type ...
To use the Client Credentials grant you have to set a Token Endpoint Auth Method other than “none”. On your Auth0 Dashboard make...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Well, I’ve got the configuration logic maybe finally. Thanks for the explanation and patience.
It’s hard to grasp and confusing
example-oauth2-server
configuration for me. Some parts are configured inapp.py
, others inoauth2.py
and maybe other files, too. I would guess a custom refresh token generator may be done by subclassing (but it’s done byOAUTH2_REFRESH_TOKEN_GENERATOR
setting). On the other hand, I would expect adding a token endpoint auth method should be some config setting, not subclassingClientCredentialsGrant
. Also, the fact thatoauth2_client.token_endpoint_auth_method
is not related toTOKEN_ENDPOINT_AUTH_METHODS
does not help to project understanding.So, I rather to not open any doc PR, since I do not feel I still understand the config logic.
It is not. And you have spelled it wrong. It is
token_endpoint_auth_method
.It is not. It is a misunderstanding from your part. It can be improved of course, but it is not wrong.
You can send a PR to example-oauth2-server.
That is how “Grant” works in authlib. You can find that other “Grants” such as AuthorizationCodeGrant, RefreshTokenGrant are required to make a subclass. If you don’t need to customize ClientCredentialsGrant, you can use it directly. But if you want to customize it, you need to subclass it. That is how other “Grants” works and I’d like to keep them in the same way.