I can obtain token in oauth2 Client Credentials flow for non confidential user #88

New issue

Closed

opened 2020-01-10 14:04:16 +01:00 by rurus9 · 2 comments

rurus9 commented

2020-01-10 14:04:16 +01:00

(Migrated from github.com)

Describe the issue
User without marked "Confidential" checkbox can obtain proper token in oauth2 Client Credentials flow

To Reproduce
Start new docker instance
docker run --rm -it -p 4593:4593 src:20200110
Add client to default "Database backend user module" (I only filled "Client ID": test1, "Name": test1, "Password", "Scope": openid and "Authorization types": client_credentials.
Confidential is not marked).

Also add oauth2 plugin (I only filled name: "oauth2", display name: "oauth2", and Tokens signature - JWT type: "RSA", Key size: "512 bits", and public and private key).

I can get proper token (in oauth2 Client Credentials flow) for this client.

Expected behavior
You can't get token in this flow for client which isn't confidential.

Screenshots

**Describe the issue** User without marked "Confidential" checkbox can obtain proper token in oauth2 Client Credentials flow **To Reproduce** Start new docker instance `docker run --rm -it -p 4593:4593 src:20200110` Add client to default "Database backend user module" (I only filled "Client ID": test1, "Name": test1, "Password", "Scope": openid and "Authorization types": client_credentials. Confidential is not marked). Also add oauth2 plugin (I only filled name: "oauth2", display name: "oauth2", and Tokens signature - JWT type: "RSA", Key size: "512 bits", and public and private key). I can get proper token (in oauth2 Client Credentials flow) for this client. **Expected behavior** You can't get token in this flow for client which isn't confidential. **Screenshots** ![Client_non_confidential](https://user-images.githubusercontent.com/46960652/72154834-fd4aff00-33b1-11ea-8442-3769f9e956db.png)

babelouest commented

2020-01-10 18:52:09 +01:00

(Migrated from github.com)

Hello @rurus9 ,

Thenka for reporting the issue, this has been fixed in github.com/babelouest/glewlwyd@93301a2529 , can you check the new version?

Hello @rurus9 , Thenka for reporting the issue, this has been fixed in https://github.com/babelouest/glewlwyd/commit/93301a2529e106315c6a1ab36cfd1ac0ac3ffb8f , can you check the new version?

rurus9 commented

2020-01-13 09:22:43 +01:00

(Migrated from github.com)

Yes, now (i built docker today) it's OK.
Thank you

Yes, now (i built docker today) it's OK. Thank you

This discussion has been locked. Commenting is limited to contributors.