<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>The minor change below in DefaultOIDCTokenService.java::createIdToken to check if AuthenticationTimeStamper.AUTH_TIMESTAMP is defined handles the problem from the pure code point of view. Not sure yet if that property is mandatory or not. Will check where
it could be defined. </div>
<div><br>
</div>
<div>
<div> if (request.getExtensions().get(AuthenticationTimeStamper.AUTH_TIMESTAMP)!=null) {</div>
<div> Long authTimestamp = </div>
<div> Long.parseLong((String) request.getExtensions().get(AuthenticationTimeStamper.AUTH_TIMESTAMP)); </div>
<div> </div>
<div> if (authTimestamp != null) {</div>
<div> idClaims.setClaim("auth_time", authTimestamp / 1000L);</div>
<div> }</div>
<div> }</div>
</div>
<div><br>
</div>
<div>Regards,</div>
<div>Luiz</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Luiz Omori <<a href="mailto:luiz.omori@dm.duke.edu">luiz.omori@dm.duke.edu</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 17, 2015 at 2:15 PM<br>
<span style="font-weight:bold">To: </span>Justin Richer <<a href="mailto:jricher@mit.edu">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [mitreid-connect] Support for Resource Owner Password Credentials<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks. I was looking exactly at that but explicitly set the authentication-manager to “authenticationManager” which apparently causes the invocation of Mitre’s DefaultOAuth2ProviderTokenService down the line. That’s the same one used for the MitreId server
itself, right?</div>
<div><br>
</div>
<div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><oauth:password authentication-manager-ref="authenticationManager" /></div>
</div>
<div><br>
</div>
<div>In any case, both seem to have the same behaviour on my system, which is an exception. See partial stack trace below. Will take a look what is causing that but let me know if you know the cause already.</div>
<div><br>
</div>
<div>…</div>
<div>
<div></pre><p><b>root cause</b></p><pre>java.lang.NumberFormatException: null</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>java.lang.Long.parseLong(Long.java:552)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>java.lang.Long.parseLong(Long.java:631)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>org.mitre.openid.connect.service.impl.DefaultOIDCTokenService.createIdToken(DefaultOIDCTokenService.java:112)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>org.mitre.openid.connect.token.ConnectTokenEnhancer.enhance(ConnectTokenEnhancer.java:128)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.createAccessToken(DefaultOAuth2ProviderTokenService.java:178)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService.createAccessToken(DefaultOAuth2ProviderTokenService.java:64)</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>org.springframework.security.oauth2.provider.token.AbstractTokenGranter.getAccessToken(AbstractTokenGranter.java:70)</div>
</div>
<div>…</div>
<div><br>
</div>
<div>Well, yes, this may be used by legacy system in our case. By the way, what is the official view for this OAuth2 flow under OpenId Connect? I’ve seen arguments about Authorization and Implicit flows being recommended by OpenId Connect, but not explicitly
saying that Client Credentials and Resource Owner are not allowed.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Luiz</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 17, 2015 at 1:34 PM<br>
<span style="font-weight:bold">To: </span>Luiz Omori <<a href="mailto:luiz.omori@dm.duke.edu">luiz.omori@dm.duke.edu</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>" <<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [mitreid-connect] Support for Resource Owner Password Credentials<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Override or edit authz-context.xml and add the following line:
<div class=""><br class="">
</div>
<div class=""><span class="blob-code-inner"><<span class="pl-ent">oauth</span><span class="pl-ent">:</span><span class="pl-ent">password</span>/></span></div>
<div class=""><span class="blob-code-inner"><br class="">
</span></div>
<div class=""><span class="blob-code-inner">next to all the other grants. And be very careful using this flow, you should only ever use it with highly trusted and legacy clients that can’t open a browser.</span></div>
<div class=""><span class="blob-code-inner"><br class="">
</span></div>
<div class=""><span class="blob-code-inner"> — Justin</span></div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jun 16, 2015, at 1:29 PM, Luiz Omori <<a href="mailto:luiz.omori@duke.edu" class="">luiz.omori@duke.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">Hi,</div>
<div class=""><br class="">
</div>
<div class="">I’ve seen a ticket requesting support for the Resource Owner (grant_type=password) flow and it’s said that it’s already supported but a special server configuration is necessary, possibly accomplished using Maven Overlays. Could you clarify exactly
which server reconfiguration is required? Currently I’m building my own test server so don’t really care about Maven Overlays at this point, can hack something directly in the build if necessary.</div>
<div class=""><br class="">
</div>
<div class="">As you suspect, my client app is getting the error below, even tough the application support for grant type password is checked:</div>
<div class=""><br class="">
</div>
<div class="">{"error":"unsupported_grant_type","error_description":"Unsupported grant type: password”}</div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
<div class="">Luiz</div>
<div class=""><br class="">
</div>
<div class=""><a href="https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/567" class="">https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/567</a></div>
<div class=""><br class="">
</div>
</div>
_______________________________________________<br class="">
mitreid-connect mailing list<br class="">
<a href="mailto:mitreid-connect@mit.edu" class="">mitreid-connect@mit.edu</a><br class="">
<a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</span></div>
</div>
</span>
</body>
</html>