/oauth/token does not allow authentication via post parameters

[omazhary]

According to docs, /oauth/token should allow either BASIC auth or or client_id and client_secret can be provided as url encoded form parameters.

We tried this in the context of https://github.com/bitly/oauth2_proxy and it turns out it"s currently only possible via BASIC authentication.

here is the error we get although we do set client_id and client_secret form parameters:

[2016-02-03 19:50:13.947] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 1 of 18 in additional filter chain; firing Filter: 'CorsFilter'
[2016-02-03 19:50:13.947] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 2 of 18 in additional filter chain; firing Filter: 'IdentityZoneResolvingFilter'
[2016-02-03 19:50:13.947] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- JdbcTemplate: Executing prepared SQL query
[2016-02-03 19:50:13.947] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- JdbcTemplate: Executing prepared SQL statement [select id,version,created,lastmodified,name,subdomain,description,config from identity_zone where subdomain=?]
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 3 of 18 in additional filter chain; firing Filter: 'DisableIdTokenResponseTypeFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- DisableIdTokenResponseTypeFilter: Processing id_token disable filter
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- DisableIdTokenResponseTypeFilter: pre id_token disable:false pathinfo:null request_uri:/oauth/token response_type:null
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- DisableIdTokenResponseTypeFilter: post id_token disable:false pathinfo:null request_uri:/oauth/token response_type:null
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 4 of 18 in additional filter chain; firing Filter: 'HttpsEnforcementFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- SecurityFilterChainPostProcessor$HttpsEnforcementFilter: Filter chain 'tokenEndpointSecurity' processing request POST /oauth/token
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 5 of 18 in additional filter chain; firing Filter: 'BackwardsCompatibleScopeParsingFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 6 of 18 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 7 of 18 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 8 of 18 in additional filter chain; firing Filter: 'HeaderWriterFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- HstsHeaderWriter: Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@4ed7cf6a
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 9 of 18 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 10 of 18 in additional filter chain; firing Filter: 'BackwardsCompatibleTokenEndpointAuthenticationFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 11 of 18 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 12 of 18 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterChainProxy: /oauth/token at position 13 of 18 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
[2016-02-03 19:50:13.948] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- FilterSecurityInterceptor: Secure object: FilterInvocation: URL: /oauth/token; Attributes: [IS_AUTHENTICATED_FULLY]
[2016-02-03 19:50:13.949] uaa - 1001 [http-bio-8080-exec-3] .... DEBUG --- ExceptionTranslationFilter: Authentication exception occurred; redirecting to authentication entry point
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
        at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:378)
        at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:222)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:123)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:168)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
        at org.cloudfoundry.identity.uaa.authentication.BackwardsCompatibleTokenEndpointAuthenticationFilter.doFilter(BackwardsCompatibleTokenEndpointAuthenticationFilter.java:166)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
        at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)

It looks like the filter enforces BASIC auth and does not check for form parameters as a fallback before failing.
Unfortunately this makes integration with https://github.com/bitly/oauth2_proxy harder (we will have to introduce UAA-specific workarounds).

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/113274509.

[fhanik]

@omazhary
What version of the UAA are you using? We recently added support for this?

Please add version and curl command

thanks
Filip

[omazhary]

We are using UAA as shipped with CloudFoundry 226. The curl command is:
curl -X POST -iv login.bosh-lite.com/oauth/token -d "client_id=<client_name>&client_secret=<client_secret>&code=<insert_code_here>&grant_type=authorization_code&response_type=token&redirect_uri=http://monitoring.bosh-lite.com/login" -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -s

You will need to create a grafana oauth client too, and a code. We just picked a code from the browser's network log during login.

[fhanik]

Already fixed via in a later version via #258

[jsievers]

great. So I understand this is fixed starting from UAA 3.0.0 i.e. CF v229 https://github.com/cloudfoundry/cf-release/releases/tag/v229

[sreetummidi]

@jsievers That is correct