AccessToken-->Password Grant

https://www.oauth.com/oauth2-servers/access-tokens/password-grant/

The Password grant is used when the application exchanges the user’s username and password for an access token. This is exactly the thing OAuth was created to prevent in the first place, so you should never allow third-party apps to use this grant.

A common use for this grant type is to enable password logins for your service’s own apps. Users won’t be surprised to log in to the service’s website or native application using their username and password, but third-party apps should never be allowed to ask the user for their password.

Request Parameters

The access token request will contain the following parameters.

• grant_type (required) – The grant_type parameter must be set to “password”.
• username (required) – The user’s username.
• password (required) – The user’s password.
• scope (optional) – The scope requested by the application.
• Client Authentication (required if the client was issued a secret)

If the client was issued a secret, then the client must authenticate this request. Typically the service will allow either additional request parameters client_id and client_secret, or accept the client ID and secret in the HTTP Basic auth header.

Example

The following is an example password grant the service would receive.

POST /oauth/token HTTP/1.1

Host: authorization-server.com

 

grant_type=password

&username=user@example.com

&password=1234luggage

&client_id=xxxxxxxxxx

&client_secret=xxxxxxxxxx

See Access Token Response for details on the parameters to return when generating an access token or responding to errors.

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 77e99b5f-d31e-4379-a64c-ddc511d42781
grant_type=passwordusername=adminpassword=passwordundefined=undefined

 https://stackoverflow.com/questions/32616069/customizing-allowed-grant-types-with-oauthauthorizationserver

To allow only the grant types you want it's enough to inherit from OAuthAuthorizationServerProvider. Then you need to override two methods:

• ValidateClientAuthentication - to validate that the origin of the request is a registered client_id
• GrantResourceOwnerCredentials - to validate provided username and password when the grant_type is set to password

For more information here is the documentation of GrantResourceOwnerCredentials method:

Called when a request to the Token endpoint arrives with a "grant_type" of "password". This occurs when the user has provided name and password credentials directly into the client application's user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token". If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate. To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token. The application should take appropriate measures to ensure that the endpoint isn’t abused by malicious callers. The default behavior is to reject this grant type.

需要注意的是：

client_credentials

Called when a request to the Token endpoint arrives with a "grant_type" of "password".

This occurs when the user has provided name and password credentials directly into the client application's user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token".

If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate.

To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token.

The default behavior is to reject this grant type. See also http://tools.ietf.org/html/rfc6749\#section-4.3.

经过测试，发现下面这个才是有效的

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: ce49a101-df6e-4b7c-9217-e112b387b784
grant_type=client_credentialsusername=adminpassword=password

换了另外一种

GET http://localhost/Chuck_WebApi/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 3b870eb3-1c29-4b5e-9dcd-297e3f582c27
User-Agent: PostmanRuntime/7.6.0
Accept: */*
Host: localhost
accept-encoding: gzip, deflate
content-length: 75
Connection: keep-alive

grant_type=password&username=admin&password=password&client_id=testClientId