https://www.oauth.com/oauth2-servers/access-tokens/password-grant/

The Password grant is used when the application exchanges the user’s username and password for an access token. This is exactly the thing OAuth was created to prevent in the first place, so you should never allow third-party apps to use this grant.

A common use for this grant type is to enable password logins for your service’s own apps. Users won’t be surprised to log in to the service’s website or native application using their username and password, but third-party apps should never be allowed to ask the user for their password.

Request Parameters

The access token request will contain the following parameters.

  • grant_type (required) – The grant_type parameter must be set to “password”.
  • username (required) – The user’s username.
  • password (required) – The user’s password.
  • scope (optional) – The scope requested by the application.
  • Client Authentication (required if the client was issued a secret)

If the client was issued a secret, then the client must authenticate this request. Typically the service will allow either additional request parameters client_id and client_secret, or accept the client ID and secret in the HTTP Basic auth header.

Example

The following is an example password grant the service would receive.

POST /oauth/token HTTP/1.1
Host: authorization-server.com
 
grant_type=password
&username=user@example.com
&password=1234luggage
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx

See Access Token Response for details on the parameters to return when generating an access token or responding to errors.

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 77e99b5f-d31e-4379-a64c-ddc511d42781
grant_type=passwordusername=adminpassword=passwordundefined=undefined

To allow only the grant types you want it's enough to inherit from OAuthAuthorizationServerProvider. Then you need to override two methods:

  • ValidateClientAuthentication - to validate that the origin of the request is a registered client_id
  • GrantResourceOwnerCredentials - to validate provided username and password when the grant_type is set to password

For more information here is the documentation of GrantResourceOwnerCredentials method:

Called when a request to the Token endpoint arrives with a "grant_type" of "password". This occurs when the user has provided name and password credentials directly into the client application's user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token". If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate. To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token. The application should take appropriate measures to ensure that the endpoint isn’t abused by malicious callers. The default behavior is to reject this grant type.

需要注意的是:

client_credentials

Called when a request to the Token endpoint arrives with a "grant_type" of "password".

This occurs when the user has provided name and password credentials directly into the client application's user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token".

If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate.

To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token.

The default behavior is to reject this grant type. See also http://tools.ietf.org/html/rfc6749\#section-4.3.

经过测试,发现下面这个才是有效的

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: ce49a101-df6e-4b7c-9217-e112b387b784
grant_type=client_credentialsusername=adminpassword=password

换了另外一种

GET http://localhost/Chuck_WebApi/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 3b870eb3-1c29-4b5e-9dcd-297e3f582c27
User-Agent: PostmanRuntime/7.6.0
Accept: */*
Host: localhost
accept-encoding: gzip, deflate
content-length: 75
Connection: keep-alive

grant_type=password&username=admin&password=password&client_id=testClientId

AccessToken-->Password Grant的更多相关文章

  1. Dynamics 365本地部署版本配置OAuth 2 Password Grant以调用Web API

    微软动态CRM专家罗勇 ,回复330或者20190504可方便获取本文,同时可以在第一间得到我发布的最新博文信息,follow me! 根据官方建议,不要再使用Dynamics 365 Custome ...

  2. 基于OWIN WebAPI 使用OAuth授权服务【客户端验证授权(Resource Owner Password Credentials Grant)】

    适用范围 前面介绍了Client Credentials Grant ,只适合客户端的模式来使用,不涉及用户相关.而Resource Owner Password Credentials Grant模 ...

  3. IdentityServer4之Resource Owner Password Credentials(资源拥有者密码凭据许可)

    IdentityServer4之Resource Owner Password Credentials(资源拥有者密码凭据许可) 参考 官方文档:2_resource_owner_passwords ...

  4. My sql添加远程用户root密码为password

    添加远程用户root密码为password grant all privileges on *.* to root@localhost identified by '123321' with gran ...

  5. springboot+spring security +oauth2.0 demo搭建(password模式)(认证授权端与资源服务端分离的形式)

    项目security_simple(认证授权项目) 1.新建springboot项目 这儿选择springboot版本我选择的是2.0.6 点击finish后完成项目的创建 2.引入maven依赖  ...

  6. IdentityServer Resource Owner Password

    Resource Owner Password 模式需要自己实现用户名密码的校验 新增ResourceOwnerPasswordValidator实现IResourceOwnerPasswordVal ...

  7. 转 - spring security oauth2 password授权模式

    原贴地址: https://segmentfault.com/a/1190000012260914#articleHeader6 序 前面的一篇文章讲了spring security oauth2的c ...

  8. SpringBoot2.x版本整合SpringSecurity、Oauth2进行password认证

    很多人在进行项目开发时都会用到Oauth2.0结合SpringSecurity或者Shiro进行权限拦截以及用户验证,网上也有很多的案例,前几天项目里边需要用到,顺便整合了进来,特此写篇博客,记录下过 ...

  9. mysql安装后改动port号password默认字符编码

    1.改动password grant all privileges on *.* to 'root'@'localhost' identified by 'new password'; 2.改动por ...

随机推荐

  1. IE8数组不支持indexOf方法的解决办法

    在使用indexof方法之前加上以下代码就可以了. if (!Array.prototype.indexOf){           Array.prototype.indexOf = functio ...

  2. ajax数据提交数据的三种方式和jquery的事件委托

    ajax数据提交数据的三种方式 1.只是字符串或数字 $.ajax({ url: 'http//www.baidu.com', type: 'GET/POST', data: {'k1':'v1'}, ...

  3. Python在向CSV文件写中文时乱码的处理办法

    前言 python2最大的坑在于中文编码问题,遇到中文报错首先加u,再各种encode.decode.当list.tuple.dict里面有中文时,打印出来的是Unicode编码,这个是无解的.对中文 ...

  4. 七牛云存储--内存put示例(go sdk)

    啥都不说了,居然有文档,有git为啥不提供example? 自己看代码,琢磨了一下,原来是要这么用的.这里不得不吐槽一下package的命名,为啥要去io?golang自带系统包名就有io啊,哥哥. ...

  5. Python高级特性(2):Closures、Decorators和functools(转)

    原文:Python高级特性(2):Closures.Decorators和functools 装饰器(Decorators) 装饰器是这样一种设计模式:如果一个类希望添加其他类的一些功能,而不希望通过 ...

  6. SpringBoot-URL路由:@Controller和@RequestMapping

    SpringBoot定义URL处理方法:@Controller和@RequestMapping @Controller标注的类表示的是一个处理HTTP请求的控制器(即MVC中的C),该类中所有被@Re ...

  7. python collections模块 计数器(counter)

    一.计数器(counter) Counter是对字典类型的补充,用于追踪值的出现次数. ps:具备字典的所有功能 + 自己的功能 把我写入的元素出现的多少次都计算出来 import collectio ...

  8. MongoDB学习笔记系列~目录

    MongoDB学习笔记~环境搭建 (2015-03-30 10:34) MongoDB学习笔记~MongoDBRepository仓储的实现 (2015-04-08 12:00) MongoDB学习笔 ...

  9. glib简单记录包括字符串,主循环,回调函数和xml解析

    一.将最近用到的glib字符串功能整理了下直接用程序记录比较好看懂 #define MAX_LEN 100gchar * demo (char* msg, ...){    gchar * pcfgf ...

  10. Django中contenttype的应用

    content_type表将app名称与其中的表的关系进行保存 通过下边的示例来理解content_type的具体应用: models: from django.db import models fr ...