Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue #240 Add disable option of password credentials grant #241

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

i7a7467
Copy link
Contributor

@i7a7467 i7a7467 commented Mar 7, 2021

Analysis

OpenAM is not able to reject the request of Resource Owner Password Credentials Grant on per OAuth 2.0 Client.

Solution

Add disable Resource Owner Password Credentials Grant option in OAuth 2.0 Client.
Update PasswordCredentialsGrantTypeHandler to check this disable option.

Install/Update

Compatibility

Performance

I18N

Add disable Resource Owner Password Credentials Grant option in OAuth 2.0 Client.(In English and Japanese)
[realm] - [agent] - [OAuth 2.0 client] - [(OAuth 2.0 client name)] - [Disable Resource Owner Password Credentials Grant]

Testing

  • Disable option is true
    • OpenAM reject the token request of grant_type=password.
  • Disable option is false
    • OpenAM does not reject the token request of grant_type=password.
  • Disable option value is not setting (ex. When OpenAM is upgraded)
    • OpenAM does not reject the token request of grant_type=password.

Regression testing

  • Anything other than grant_type=password will not be rejected.

* add disable option(isPasswordCredentialsGrantDisabled) of password credentials grant in OAuth 2.0 Client
* update PasswordCredentialsGrantTypeHandler to check this disable option
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant