FOSOAuthServerBundle icon indicating copy to clipboard operation
FOSOAuthServerBundle copied to clipboard

Unauthorized errors with grant type client_credentials

Open null-ref-0000 opened this issue 7 years ago • 1 comments

Is it possible to setup FOSOAuth bundle without requiring a user and password to obtain a token?

I have been able to obtain a access_token without a user name and password.

http://127.0.0.1:8000/oauth/v2/token?client_id=XXX&client_secret=XXX&grant_type=client_credentials

But when I attempt to use the access_token on an endpoint I get access denied response. I have tried setting access_token in url params as well as header

POST /v0/customers?access_token=NzU1ZTIw HTTP/1.1 Host: 127.0.0.1:8000 Connection: keep-alive Content-Length: 150148 Authorization: Bearer NzU1ZTIw Postman-Token: 75fba0f2 Cache-Control: no-cache Origin: chrome-extension://fhbjgbiflinjbdggehcddcbncdddomop User-Agent: Mozilla/5.0 Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.8

I am only protecting specific API endpoints and thus I have add this to one I want to require oauth authorization.

    if (false === $this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_FULLY')) {
        throw new HttpException(401, "Not authorized");
    }

null-ref-0000 avatar Jun 16 '17 02:06 null-ref-0000

I'm having the same difficulty. I assume I have something wrong in my configuration, but I don't know what.

Also, since the access_token is acquired by client_credentials, it is not connected to any user and I wonder if that is making symfony think that no user is authenticated...

@alcaeus, can you help?

Evertt avatar Nov 13 '19 11:11 Evertt