Here's the relevant quote from 2.3.1:
Alternatively, the authorization server MAY support including the
client credentials in the request-body using the following
parameters:
...
Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes). The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.
As you see, this method MAY be supported, which also means it MAY NOT be.
It may even be rejected, since there's no language preventing that in the
RFC.
Further, your "do both" solution violates the RFC.
So, it's either best to add a new config option to the module (eg
"send_secret_in_body" or something like that) or just remove it completely
(since that is the RFC's recommended practice), as it is likely that no one
will notice anyway. While your code clearly passed on big sites like
Google, there may be many more sites like the one I encountered. That might
even be the default for the OAuth2 library they're using. Net::OAuth2 works
great, now that I figured out the problem. Once I got my head around how it
works, it's very simple and easy to use. Thanks.
One other thing. Why does an auth failure die? Yes, I can eval it, but why
require that? Also, in order to diagnose the problem, I had to add
debugging output to the code to print the entire request header and body.
Some sort of verbose output would be nice.
Scott
On Mon, Jun 16, 2014 at 9:06 AM, Scott Weisman <sweisman@pobox.com> wrote:
Show quoted text> This is a hard-coded solution to make it work for the server I am
> connecting to in WebServer.pm (my additions and comments in bold):
>
> sub get_access_token($@)
> { my ($self, $code, @req_params) = @_;
>
> # rfc6749 section "2.3.1. Client Password"
> # header is always supported, client_id/client_secret may be. We do
> both.
> my $params = $self->access_token_params(code => $code, @req_params);
> my $basic = encode_base64
> "$params->{client_id}:$params->{client_secret}"
> , ''; # no new-lines!
>
> *delete($$params{client_id}); # above you say that "header is always
> supported, client_id/client_secret may be. We do both."*
> *delete($$params{client_secret}); # At the server I am trying to auth
> with, **client_id/client_secret ARE NOT SUPPORTED and in fact cause the
> auth request to be denied.*
> *# so I delete them after $basic is calculated but before build_request is
> invoked, so they are not in the POST request body.*
> *# since header is ALWAYS supported as you say, that is the only needed
> method anyway*
> *# it just happens that sites like Google ignore them, but not all sites
> do*
>
> my $request = $self->build_request
> ( $self->access_token_method
> , $self->access_token_url
> , $params
> );
>
> $request->headers->header(Authorization => "Basic $basic");
> my $response = $self->request($request);
>
> Net::OAuth2::AccessToken->new
> ( profile => $self
> , auto_refresh => !!$self->auto_save
> , $self->params_from_response($response, 'access token')
> );
> }
>
>
>
> On Mon, Jun 16, 2014 at 12:00 AM, Mark Overmeer via RT <
> bug-Net-OAuth2@rt.cpan.org> wrote:
>
>> <URL:
https://rt.cpan.org/Ticket/Display.html?id=96454 >
>>
>> * Scott Weisman via RT (bug-Net-OAuth2@rt.cpan.org) [140615 00:13]:
>> > Sat Jun 14 20:13:01 2014: Request 96454 was acted upon.
>> > Transaction: Ticket created by sweisman@pobox.com
>> > Queue: Net-OAuth2
>> > Subject: using client_id and client_secret in get_access_token()
>> > Requestors: sweisman@pobox.com
>> > Ticket <URL:
https://rt.cpan.org/Ticket/Display.html?id=96454 >
>> ...
>> > It turns out that QQ Catalyst's OAuth2 server did not like having the
>> > client_id and client_secret in the POST content.
>>
>> Can you supply a patch, so I can see exactly what works for you?
>> --
>> Regards,
>> MarkOv
>>
>> ------------------------------------------------------------------------
>> Mark Overmeer MSc MARKOV Solutions
>> Mark@Overmeer.net solutions@overmeer.net
>>
http://Mark.Overmeer.net http://solutions.overmeer.net
>>
>>
>>
>
