Password Credentials - Client ID about guzzle-oauth2-plugin

[bojanz]

That is correct. From the RFC you linked:

The authorization server MUST:

require client authentication for confidential clients or for any
client that was issued client credentials (or with other
authentication requirements),

So, each flow requires a client_id unless your server allows every client. We've yet to come across such a use case.

[stephenheron]

Hi Bojan,

Thanks for getting back to me so quickly!

The RFC shows this as a example for getting an access token:

POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded
grant_type=password&username=johndoe&password=A3ddj3w

It does not contain the client_id. I thought the section that you quoted was discussing the requirement for Basic Auth but I may be wrong.

Thanks,
Stephen

[pjcdawkins]

Hi Stephen

The client ID in that is czZCaGRSa3F0MzpnWDFmQmF0M2JW

[pjcdawkins]

Client credentials can be sent in the body as 'client_id' and 'client_secret', or in Basic authentication - see #16

[stephenheron]

Hi Patrick,

Ah right ok I see now! Thanks for clearing that up.

Do you know when your pull request will be merged in?

Thanks,
Stephen

[pjcdawkins]

Done! I'll tag a release with that soon (I want to review the other PR first) - if that all makes sense then please close this issue

[stephenheron]

Fantastic!

Thanks everyone this is maybe the best interaction I have ever had on GitHub.

Keep up the good work ;)

Thanks,
Stephen

[stephenheron]

Hi Guys,

Sorry for reopening the issue but I might have noticed another wee issue.

In change that was made to add the client_id/client_secret to the headers: GrantTypeBase.php Line 70. The client_id and client_secret are being unset from the $body but on line 66 the body has already been assigned to the $requestOptions array. Meaning that the unset on line 70 has no effect.

Thanks,
Stephen

[pjcdawkins]

Correct... I'll fix that...!

[pjcdawkins]

Thanks