Spring Security OAuth2 Credentiais through header - spring-security-oauth2

Question

Well, i'm creating a Authorization Server using Spring Security OAuth Project, this is my configurer class:
#Configuration
public class AuthConfig extends AuthorizationServerConfigurerAdapter {
private final AuthenticationManager authenticationManager;
public AuthConfig(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("clientid")
.secret(passwordEncoder().encode("secret"))
.authorizedGrantTypes("authorization_code", "client_credentials", "password")
.scopes("myscope")
.redirectUris("http://localhost:8080/oauth/login/client-app");
}
/**
* Precisamos para uso do Password Flow
*/
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authenticationManager).
tokenStore(tokenStore())
.accessTokenConverter(accessTokenConverter());
}
#Bean
PasswordEncoder passwordEncoder() {
return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}
#Bean
TokenStore tokenStore() {
return new JwtTokenStore(accessTokenConverter());
}
#Bean
JwtAccessTokenConverter accessTokenConverter() {
JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
jwtAccessTokenConverter.setSigningKey("ABC");
return jwtAccessTokenConverter;
}
}
Well, when I try to retrieve the Access Token i need pass "clientid" and "secret" through headers, like this (works very well returning the JWT Token):
curl clientid:secret#localhost:8080/oauth/token -dgrant_type=client_credentials -dscope=myscope
But if I try this:
curl localhost:8080/oauth/token -dgrant_type=client_credentials -dscope=transferir-valores -dclient_id=clientid -dclient_secret=secret
I got Unauthorized message.

Answer 1

The second request is incorrect and that is why you're getting an unauthorized message.
Check the following excerpt from the specification:
Clients in possession of a client password MAY use the HTTP Basic
authentication scheme as defined in [RFC2617] to authenticate with the
authorization server. The client identifier is encoded using the
"application/x-www-form-urlencoded"
Alternatively, the authorization server MAY support including the client credentials in the request-body.
Including the client credentials in the request-body using the two parameters is NOT RECOMMENDED
It is recommended to send client credentials as basic auth (encode credentials to base64 as add it to headers). Something like this:
curl -X POST \ http://localhost:8443/auth-service/oauth/token \ -H 'Authorization: Basic VEVTVF9TRVJWSUNFOnBhc3N3b3Jk' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d grant_type=client_credentials