16

I'm trying to understand and implement a client credentials flow between our new REST server and our existing client app. I've setup spring-security OAuth2 like this. From my understanding so far, my server should now support the following request:

$ curl -X -v -d 'client_id=the_client&client_secret=secret&grant_type=client_credentials' -X POST "http://localhost:9090/oauth/token"

but I get 

InsufficientAuthenticationException: There is no client authentication

caused by the Principal being null here (spring-security code) :

@FrameworkEndpoint
@RequestMapping(value = "/oauth/token")
public class TokenEndpoint extends AbstractEndpoint {

    @RequestMapping
    public ResponseEntity<OAuth2AccessToken> getAccessToken(Principal principal,
            @RequestParam("grant_type") String grantType, @RequestParam Map<String, String> parameters) {

        if (!(principal instanceof Authentication)) {
            throw new InsufficientAuthenticationException(

So it seems, I need to authenticate against the server first. But that's not what I want to do. I want two of my servers to talk to each other using a shared secret. The OAuth provider server should provide an access token to the (trusted) client server on request so that the client server can then use that token to access all REST resources on the server. This should protect the REST resources from external access.

Later I want to provide selected resources to a third party and eventually implement some finer grained security for the server-to-server communication as well. But for now I need to protect the REST server from external access.

Looks like I might have some misunderstandings about the whole client credentials flow or the application of spring-security right there so any clarification would be greatly appreciated.

Community
  • 1
  • 1
Pete
  • 10,720
  • 25
  • 94
  • 139

1 Answers1

19

You are not authenticating your client to the Authorization server.

You need to do something like this:

curl --user the_client:secret --data "grant_type=client_credentials" http://localhost:9090/oauth/token

This is authenticating the client to the authorization server and then specifying grant_type and other parameters. This will return an access token of type 'bearer' with scope determined by the oauth client details. Once you have the token, you can access your protected resources by setting the Authorization header:

curl -H "Authorization: Bearer <accessToken>" <resourceUrl>
kldavis4
  • 2,177
  • 1
  • 22
  • 33
  • Thanks for your answer. So my train of thought is basically correct? For the client credentials flow I request a token with the client credentials and grant type and then use that token to access the protected resources? I think I just have a setup error, because using the sparklr example project the call I mentioned above does work.. – Pete Jan 04 '13 at 09:05
  • I think you are on the right track. The client requests a token first using a particular grant type. Then you just pass the token in the auth header when accessing the protected resource. I have updated my answer with an example of accessing the resource. – kldavis4 Jan 04 '13 at 14:46