Oauth Password Flow Basic Auth question?

I’m trying to work out if our OAuth server is missing a grant or whether this is incorrect use of the grant.

The password flow in the authorize step with basic auth seems to curl 'https://api.domain.com/oauth2/token' -H 'authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=' -H 'content-type: application/x-www-form-urlencoded' -H 'access-control-allow-origin: *' -H 'accept: application/json, text/plain, */*' --data 'grant_type=password

Where the basic auth contains the username/password of the user. However I can’t find this in the RFC. Should this not contain the user/pass in the body with the client_id/secret in the the basic auth header?

[matzetronic]

The thing that is not implemented (and I don’t feel like it should be implemented ever) is the “But additionally our /oauth/token endpoint is protected by basic auth”.

But isn’t that exactly what https://docs.cloudfoundry.org/api/uaa/#with-authorization describes?

[matzetronic]

Since I’m not an expert with oauth and security I don’t know if that makes sense or not. I’m just stuck since I can’t get it to work. By the way, my token endpoint is https://docs.cloudfoundry.org/api/uaa/#with-authorization so I don’t think I will be the only one with that problem in the future…