ResourceOwnerPasswordResourceDetails - Pass clientid and secret to generate oauth2 token

java, oauth-2.0, spring, spring-boot, spring-security

Solution

Your client uses HTTP basic authentication scheme by default, but your server expects "form" authentication scheme.

Your server is not OAuth 2 compliant, see RFC 6749:

2.3.1. Client Password

Clients in possession of a client password MAY use the HTTP Basic authentication scheme as defined in [RFC2617] to authenticate with the authorization server. The client identifier is encoded using the "application/x-www-form-urlencoded" encoding algorithm per Appendix B, and the encoded value is used as the username; the client password is encoded using the same algorithm and used as the password. The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a client password.

But you can change the authentication scheme of your client to "form", see OAuth 2 Developers Guide:

`clientAuthenticationScheme:` The scheme used by your client to authenticate to the access token endpoint. Suggested values: "http_basic" and "form". Default: "http_basic". See section 2.1 of the OAuth 2 spec.

Problem

I followed the accepted answer mentioned in this question to generate OAuth2 token. However I get HTTP 401 response. When I debugged, I saw that `clientid` and `clientsecret` are not passed as part of form in the HTTP request. I only see the below listed values being passed. Should I do anything additional in order to pass `clientid` and `clientsecret` as well? ``` {grant_type=[password], username=[username], password=[password]} ```

Original source

Related problems