question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

OAuth2 ClientCredential grant custom expiration not being read from Flask configuration.

See original GitHub issue

Summary

When registering a client credential grant for the authlib.flask.oauth2.AuthorizationServer in a Flask application and attempting to set a custom expiration time by setting OAUTH2_EXPIRES_CLIENT_CREDENTIAL as specified in the docs:

https://github.com/lepture/authlib/blob/23ea76a4d9099581cd1cb43e0a8a9a49a9328361/docs/flask/oauth2.rst#define-server

the specified custom expiration time is not being read.

Investigation

At first I believe that there was simply an error in the docs, in that the configuration value key should be pluralized, e.g. OAUTH2_EXPIRES_CLIENT_CREDENTIALS. However, upon a deeper look, it seems as though the default credential grant expiration time set in the authlib code base was not being used at all; the value being returned was 3600 instead of 864000 as specified in the mapping:

https://github.com/lepture/authlib/blob/7d2a7b55475e458c7043238bc4642e55c39fd449/authlib/flask/oauth2/authorization_server.py#L15-L20

After a bit more digging, it seems that the create_expires_generator is returning the default BearerToken.DEFAULT_EXPIRES_IN value because the calculated conf_key = 'OAUTH2_EXPIRES_{}'.format(grant_type.upper()) only produces client_credentials instead of the expected client_credential:

https://github.com/lepture/authlib/blob/7d2a7b55475e458c7043238bc4642e55c39fd449/authlib/flask/oauth2/authorization_server.py#L124-L136

Notes

A very subtle bug that took me a while to track down; I attempted to create a test case, but it’s not very obvious as to where the test case should exist since tests/flask/test_oauth2/test_client_credentials_grant.py is composed of functional tests as opposed to integration/unit tests.

If this is at all not clear, please let me know and I’ll attempt to provide additional information.

And thank you for all your hard work! Authlib is fantastic, and has been a pleasure to use even in it’s not-completely-done state.

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:5 (2 by maintainers)

github_iconTop GitHub Comments

1reaction
lepturecommented, Apr 20, 2018

Fixed.

1reaction
lepturecommented, Apr 20, 2018

Thanks for your report. I believe it is a typo, the grant_type should be client_credentials, not client_credential. I will fix it asap.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Flask-OAuthlib Documentation
Note: You SHOULD read Flask OAuth 2.0 Provider documentation. An OAuth2 server concerns how to grant the authorization and how to protect the ......
Read more >
OAuth 2.0
The flows (also called grant types) are scenarios an API client performs to get an access token from the authorization server. OAuth 2.0...
Read more >
Flask OIDC: oauth2client.client.FlowExchangeError
I configured an OpenAM client agent as follows: Client ID = MyClientID; Client Secret = password; Response Type = code; Token Endpoint ...
Read more >
How to Use Client Credentials Flow with Spring Security
Learn how to use OAuth 2.0's client credentials grant to ... some of this logic manually because it is not being auto-configured for...
Read more >
OAuth 2 Session — Authlib 1.2.0 documentation
If you are not familiar with OAuth 2.0, it is better to read Introduce OAuth ... in OAuth 2 to obtain an access...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found