Search code examples
springspring-securityoauth-2.0spring-security-oauth2spring-oauth2

How do you use a non-password grant type in Spring Security Oauth2?

I see that Spring Security Oauth2 has different grant types:

https://projects.spring.io/spring-security-oauth/docs/oauth2.html#grant-types

How do you use a grant type that is not password?

I currently have password based authentication working.

$ curl -u client:123456 http://localhost:8080/oauth/token -d grant_type=password -d username=admin -d password=admin -d client_id=client -d client_secret=123456 -d scope=write
{"access_token":"40add879-3be3-4d94-b969-4dc17975c659","token_type":"bearer","refresh_token":"583eb284-3318-432b-a8a3-b3eee744c9b7","expires_in":40688,"scope":"write"}

I commented out 

@EnableAuthorizationServer
public class OAuth2Configuration extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
            .tokenStore(this.tokenStore).userDetailsService(userDetailsService);
//          .authenticationManager(new AuthenticationManager() {
//          @Override
//          public Authentication authenticate(Authentication authentication)
//                  throws AuthenticationException {
//              return authenticationManagerBuilder.getOrBuild().authenticate(authentication);
//          }
//      });

So it would no longer use password grant types. ("password grants are switched on by injecting an AuthenticationManager").

I then searched the API for 'grant'

https://docs.spring.io/spring-security/oauth/apidocs/index.html

I then tried 

$ curl -u client:123456 http://localhost:8080/oauth/token -d grant_type=token -d client_id=client -d client_secret=123456 -d scope=write
{"error":"unsupported_grant_type","error_description":"Unsupported grant type: token"}
$ curl -u client:123456 http://localhost:8080/oauth/token -d grant_type=client -d client_id=client -d client_secret=123456 -d scope=write
{"error":"unsupported_grant_type","error_description":"Unsupported grant type: client"}
$ curl -u client:123456 http://localhost:8080/oauth/token -d grant_type=code -d client_id=client -d client_secret=123456 -d scope=write
{"error":"unsupported_grant_type","error_description":"Unsupported grant type: code"}

So how do you create a client/secret only grant type to get an access token, without using an username and password in the database? Nowhere can I find a list of valid grant_types!

This seems to be the method to define the allowed grant types, but it doesn't specify the valid values.

https://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/config/annotation/builders/ClientDetailsServiceBuilder.ClientBuilder.html#authorizedGrantTypes(java.lang.String...)

Solution

  • For Client Credentials based token use client_crendentials as grant_type.

    $ curl -u client:123456 http://localhost:8080/oauth/token -d grant_type=client_crendentials -d client_id=client -d client_secret=123456 -d scope=write

    There is no list of grant_types as such because grant types are defined using TokenGranter interface which can be implemented by anyone. However at the moment there are four main grant_type implemented out of the box in Spring Security OAuth2 framework which are following:

    1. implicit
    2. client_credentials
    3. password
    4. refresh_token

    You can use any of the above as grant_type