java - ResourceOwnerPasswordResourceDetails - 传递 clientid 和 secret 以生成 oauth2 token

Question

我遵循了此 question 中提到的公认答案生成 OAuth2 token 。但是我收到 HTTP 401 响应。当我调试时，我看到 clientid 和 clientsecret 没有作为 HTTP 请求中表单的一部分传递。我只看到下面列出的值被传递。为了传递 clientid 和 clientsecret 我还应该做些什么吗？

{grant_type=[password], username=[username], password=[password]}

Answer 1

您的客户端默认使用 HTTP 基本身份验证方案，但您的服务器需要“表单”身份验证方案。

您的服务器不符合 OAuth 2 标准，请参阅 RFC 6749 :

2.3.1. Client Password

Clients in possession of a client password MAY use the HTTP Basicauthentication scheme as defined in [RFC2617] to authenticate withthe authorization server. The client identifier is encoded using the"application/x-www-form-urlencoded" encoding algorithm perAppendix B, and the encoded value is used as the username; the clientpassword is encoded using the same algorithm and used as thepassword. The authorization server MUST support the HTTP Basicauthentication scheme for authenticating clients that were issued aclient password.

但是您可以将客户端的身份验证方案更改为“表单”，参见OAuth 2 Developers Guide :

clientAuthenticationScheme: The scheme used by your client to authenticate to the access token endpoint. Suggested values: "http_basic" and "form". Default: "http_basic". See section 2.1 of the OAuth 2 spec.