Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create Access Token without grant #28

Closed
ArcoMul opened this issue Jan 22, 2013 · 3 comments
Closed

Create Access Token without grant #28

ArcoMul opened this issue Jan 22, 2013 · 3 comments
Assignees
@ammmir

Comments

@ArcoMul
Copy link

ArcoMul commented Jan 22, 2013

Hello,

I'm not an OATH (2) expert, so I may be completely wrong.
When using your module I encountered the situation that I wanted to return an access token without first getting the permission of the user.

So by sending the client secret + username + password I immediately return an access token since it is a trusted client.

Is it an idea to add this option to the module?
@ammmir
Copy link
Owner

ammmir commented Jan 22, 2013

yes, this is sometimes known as xAuth, whereby you exchange credentials for a long-lived access token.

@ghost ghost assigned ammmir Jan 22, 2013
ammmir added a commit that referenced this issue Jan 22, 2013
@ammmir
Add client authentication (xAuth) for trusted clients (#28).
074f9a8 
This adds an optional `client_auth` event that is emitted whenever an
access token request is made with grant_type=password. It is meant to be
used only for client-side applications that can be trusted to handle a
user's credentials directly.

For example, this will generate an access token in one shot:

$ curl -XPOST "http://1:1secret@localhost:8081/oauth/access_token" \
       -d "grant_type=password&username=guest&password=leet"

In addition, access token requests may now include client_id and
client_secret as the username and password, respectively, in the HTTP
Authorization header using Basic authentication.
@ammmir
Copy link
Owner

ammmir commented Jan 22, 2013

@ArcoMul can you test this out and let me know if it works for you?

@ArcoMul
Copy link
Author

ArcoMul commented Jan 23, 2013

Yes, this works fine for me :-) And apparently I was talking about xAuth yes, thanks for the right term

@ammmir ammmir closed this as completed Apr 10, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ammmir ammmir

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ammmir @ArcoMul