Client Credential Grant type Confusion

[dclarke-modus]

Good day:I

'm going through the documentation for Node-Oauth-Server2 however, I'm a bit confused based on this documentation for method getUserFromClient https://oauth2-server.readthedocs.io/en/latest/model/spec.html#model-getuserfromclient used for Client_Credential grant type. My understanding of Client_Credential grant type is that there's no association with any user and this type simple allows for verification of a client app against the service provider. I'm confused at this point what user is associated with a client for this grant type.

The only grant type I know there's an association of a client app with user is the password grant type. Kindly let me know if there's any discrepancy with my understanding.Thanks.

[elliotlings]

I think I'm having the same problem.

User should be optional? I use a PHP library which doesn't require a user for client_credential grant.

[HenrikGr]

I need clarification about this as well?

[mjsalinger]

The token endpoint requires a user, regardless of the grant type - so in this case, the method could be used to set the user to the same object as the client (or a subset of that object that would be returned or available to the user).

[devnill]

Is there a reason this method is being called? Since neither getClient nor getUserFromClient receive the grant type, one would need to ensure that the values of client_id and username do not collide in order to avoid escalation of privileges.

This doesn't appear to be a violation of RFC6749, but it certainly could lead to dangerous implementations without extra care.

[katanacrimson]

Going by a gut guess - this may be a way to rig up the oauth2-server to use a generic "anonymous" user when using client_credentials grant type. That way, when oauth2-server kicks back a user object from one of the many methods of credential granting, it will always be the same "user" structure, just the same as the other grant mechanisms will produce when authenticated. It is opinionated though, and requires having a "null user" of some sort in order to achieve this.

I will say that the example doesn't seem to correlate with that, but...the example for the getUserFromClient method doesn't help anyways, and if that were the case it'd be better off named "getOwnerFromClient".

[likexoo]

+1 It seems that the only solution is return an empty object from getUserFromClient as described in this.