ResourceOwnerPasswordResourceDetails - Pass clientid and secret to generate oauth2 token
java, oauth-2.0, spring, spring-boot, spring-security
Solution
Your client uses HTTP basic authentication scheme by default, but your server expects "form" authentication scheme.
Your server is not OAuth 2 compliant, see RFC 6749:
2.3.1. Client Password
Clients in possession of a client password MAY use the HTTP Basic authentication scheme as defined in [RFC2617] to authenticate with the authorization server. The client identifier is encoded using the "application/x-www-form-urlencoded" encoding algorithm per Appendix B, and the encoded value is used as the username; the client password is encoded using the same algorithm and used as the password. The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a client password.
But you can change the authentication scheme of your client to "form", see OAuth 2 Developers Guide:
`clientAuthenticationScheme:` The scheme used by your client to authenticate to the access token endpoint. Suggested values: "http_basic" and "form". Default: "http_basic". See section 2.1 of the OAuth 2 spec.
Problem
I followed the accepted answer mentioned in this question to generate OAuth2 token. However I get HTTP 401 response. When I debugged, I saw that `clientid` and `clientsecret` are not passed as part of form in the HTTP request. I only see the below listed values being passed. Should I do anything additional in order to pass `clientid` and `clientsecret` as well? ``` {grant_type=[password], username=[username], password=[password]} ```