Error response code not compliant to RFC 6749

[neelalex]

What version of UAA are you running?

76.22.0 (latest)

How are you deploying the UAA?

as part of a commercial Cloud Foundry distribution

What did you do?

I am trying to generate access tokens using the token endpoint - {authenticationUrl}/oauth/token

What did you expect to see? What goal are you trying to achieve with the UAA?

with invalid client credentials, the error response was expected to be as follows:

• Code: 401 Unauthorized
• Body:
  - “error”: “invalid_grant”
  • “error_description”: “Bad credentials”

What did you see instead?

with invalid client credentials, the error response is as follows:

• Code: 401 Unauthorized
• Body:
  - “error”: “unauthorized”
  • “error_description”: “Bad credentials”

Question 1: in RFC6749 section 5.2 - “unauthorized” is not in the list of allowed ‘error codes’. We should use an error response code from this available list of codes.
Question 2: in RFC6749 section 5.2 - suggests a 400 unless specified otherwise. Any reason why we use a 401?

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/186262249

The labels on this github issue will be updated when the story is started.

[neelalex]

Is there any update on the same?

[strehle]

Hi @neelalex

Ok, I simply checked client credential agains some others.

Others reply with

401
{"error":"invalid_client","error_description":"Client authentication failed"}

Azure tells a long story in error_description, but also invalid_client in error

So yes, we should fix it in UAA.

Are you able to create a fixing PR ? This would increase the time until we get the fix.

[strehle]

@Tallicia FYI, BadCredential in UAA is not from OAuth2Exception , so we should move to own Exception . In spring-security-oauth2 library there would be an extra Exception -> BadClientCredentialsException, but this is depcrecated because the library is depcrecated... so we need to do it on our own

[neelalex]

Hi team,
I can see there is a Pull Request open, when can we expect the fix to be available and in which version?

[strehle]

yes the PR is in review, it is small but we need some time. We will change only the error text, but if a client would use exsisting error text, it would fail

[strehle]

created #2596 as alternative

[strehle]

@neelalex we will fix this soon with PR #2596 , please check if this would solve it for you