Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-11402

OpenAM does not enforce OAuth2 spec for "Resource Owner Password Credentials Grant" flow

    Details

    • Sprint:
      AM Sustaining Sprint 41, AM Sustaining Sprint 42, AM Sustaining Sprint 43, AM Sustaining Sprint 44
    • Story Points:
      3
    • Needs backport:
      No
    • Support Ticket IDs:
    • Verified Version/s:
    • Needs QA verification:
      No
    • Functional tests:
      No
    • Are the reproduction steps defined?:
      Yes and I used the same an in the description

      Description

      Bug description

      OpenAM accepts Resource Owner credentials as part of the query string

      How to reproduce the issue

      Configure OAuth2 provider and OAuth2 client

      Perform Resource Owner Password Credential Grant flow, but specify parameter username and password as part of the query string instead of the POST body.

      Expected behaviour
      OpenAM should respond  with an error code as the spec says
      
      
      4.3.2.  Access Token Request
      
         The client makes a request to the token endpoint by adding the
         following parameters using the "application/x-www-form-urlencoded"
         format per Appendix B with a character encoding of UTF-8 in the HTTP
         request entity-body:
      
         grant_type
               REQUIRED.  Value MUST be set to "password".
         username
               REQUIRED.  The resource owner username.
         password
               REQUIRED.  The resource owner password.
         scope
               OPTIONAL.  The scope of the access request as described by
               Section 3.3.
      
      Current behaviour
      OpenAM issues access token
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                sfraser Sam Fraser
                Reporter:
                bthalmayr Bernhard Thalmayr
              • Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 4h Original Estimate - 4h
                  4h
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 6h
                  6h