You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Keith Wall (JIRA)" <ji...@apache.org> on 2018/04/24 16:52:00 UTC
[jira] [Commented] (QPID-8172) [Broker-J] OAuth2 authentication
provider should not mandate setting of client secret
[ https://issues.apache.org/jira/browse/QPID-8172?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16450199#comment-16450199 ]
Keith Wall commented on QPID-8172:
----------------------------------
Furthermore, I notice that "2.3.1. Client Password" goes on to say:
{quote}Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes). The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.{quote}
{{OAuth2AuthenticationProviderImpl#authenticateViaAuthorizationCode}} implementation is at odd with this. If the endpoint basic auth, then the client id and client secret should not be sent as part of the body.
> [Broker-J] OAuth2 authentication provider should not mandate setting of client secret
> -------------------------------------------------------------------------------------
>
> Key: QPID-8172
> URL: https://issues.apache.org/jira/browse/QPID-8172
> Project: Qpid
> Issue Type: Bug
> Components: Broker-J
> Affects Versions: qpid-java-6.1.6, qpid-java-broker-7.0.3
> Reporter: Alex Rudyy
> Priority: Major
>
> The current implementation of OAuth2 authentication provider requires specifying "client secret". However, the client secret can be an empty string and can even be omitted in the request if it is empty. As per [RFC6749|https://tools.ietf.org/html/rfc6749], section "2.3.1. Client Password":
> {quote}
> client_secret
> REQUIRED. The client secret. The client MAY omit the
> parameter if the client secret is an empty string.
> {quote}
> Thus, OAuth2 authentication provider should not mandate setting of client secret.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org