The OAuth2 password
grant_type
states,
If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in Section 3.2.1.
Let's assume that I have both confidential and non-confidential clients. This seems like a very plausible assumption: I have some third-party developers, who run server side applications, and they are thus issued a client_id
& client_secret
pair; I also have a mobile application and a web application; obviously these can't keep the client_secret
confidential, as they're published publicly.
So, in the case of a public client w/o a client secret, the above "If the client type is confidential" is false, and they don't authenticate with the authorization server as described by §3.2.1.
However, as a server,
The authorization server MUST:
- require client authentication for confidential clients or for any client that was issued client credentials (or with other authentication requirements),
Okay, but given that the above text means that only confidential clients will send their credentials, how is this possible? If I don't see credentials on the request, how do I, as an authorization server, know that this is a public client, as opposed to a confidential client that has failed to supply authentication?
Note that in "OAuth2 Simplified", there is an example grant_type=password
request that includes a client_id
, but not a client_secret
; does OAuth require that at least a client_id
is always specified during grants? (And thus, the authorization server could identify the client, and thus, whether they need to fully authenticate.) Does the RFC state this anywhere?
client_id
's for confidential and non-confidential clients?