OAuth ClientCredentials doesn't pass client_id and client_secret in request body. about swagger-ui

[PSanetra]

I stumbled over this issue in context of Microsoft Entry ID, too.
The client_id and client_secret are not passed as form parameters. Instead the Authorization header is used. This is genereally also supported by Microsoft:

The client_secret parameter documentation mentions:

The Basic auth pattern of instead providing credentials in the Authorization header, per RFC 6749 is also supported.

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow#first-case-access-token-request-with-a-shared-secret

The true cause of this issue seems to be that Microsoft seems to have stopped support for the client_credentials flow to be called from a website.

You can confirm this by trying out the following curl requests:

Token request without origin header

> curl https://login.microsoftonline.com/${YOUR_TANENT_ID}/oauth2/v2.0/token \
  -d 'grant_type=client_credentials' \
  -d "scope=${YOUR_CLIENT_ID}/.default" \
  -d "client_id=${YOUR_CLIENT_ID}" \
  -d "client_secret=${YOUR_CLIENT_SECRET}"
{"token_type":"Bearer","expires_in":3599,"ext_expires_in":3599,"access_token":"...your_token..."}

Token request with origin header like a request would be issued in a browser

> curl -v https://login.microsoftonline.com/${YOUR_TANENT_ID}/oauth2/v2.0/token \
  -H 'Origin: http://localhost:8080' \
  -d 'grant_type=client_credentials' \
  -d "scope=${YOUR_CLIENT_ID}/.default" \
  -d "client_id=${YOUR_CLIENT_ID}" \
  -d "client_secret=${YOUR_CLIENT_SECRET}"
[...]
< HTTP/2 400
[...]
{"error":"invalid_request","error_description":"AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'http://localhost:8080'. Trace ID: [...] Correlation ID: [...] Timestamp: [...]","error_codes":[9002326],"timestamp":"[...]","trace_id":"[...]","correlation_id":"[...]","error_uri":"https://login.microsoftonline.com/error?code=9002326"}

I don't think this issue can be solved by swagger-ui. Microsoft would need to enable support for client_credentials flow from browsers again.

[mattfrear]

Hi @PSanetra thank you for adding your findings. Nice work figuring out that Origin header is the issue!

I wonder if there is some magic value of the Origin header which it will accept?

I don't think this issue can be solved by swagger-ui.

I agree it's not a Swagger UI issue.

Microsoft would need to enable support for client_credentials flow from browsers again.

I wonder if there is some config in our Entra ID App Registration's manifest which would allow this?

[PSanetra]

@mattfrear good question if there is some configuration option for this. I would be interested too.

For now I will go with simple Authorization header with Bearer scheme in swagger ui and show some description how to get the client_credentials token via curl as a workaround.

[mattfrear]

Closing this because it's not a Swagger UI issue, it's caused by Entra ID rejecting client_credentials requests which have an Origin header.