Client secret should be nullable

[bburnichon]

From the code, Client::checkSecret($secret) compares given secret to internal secret when set.

To authorize identification from clients without access to secret (for example: javascript or mobile), the checkSecret should succeed, so $this->secret set to null. Mapping does not allow this.

[Spomky]

Duplicate of #266

[nclavaud]

Mapping allows an empty string, though.

For the record, I solved the very same problem by:

• setting the secret to an empty string for non-confidential clients (javascript or mobile apps);
• extending the Client class and overriding the checkSecret method like so:

class MyClient extends \FOS\OAuthServerBundle\Entity\Client
{
    public function checkSecret($secret)
    {
        // secret can be omitted for public (non-confidential) clients
        if ('' === $this->secret && null === $secret) {
            return true;
        }

        return parent::checkSecret($secret);
    }
}