Password Grant Type with WSO2 IS from Scratch
🧬 Introduction
The Password Grant flow is an OAuth2.0 grant type that enables a client application to obtain an access token by presenting the user’s username and password directly to the Authorization Server. This flow is considered to be less secure since it requires the client application to handle and transmit the user’s credentials.
Therefore, this grant is used in scenarios where the client application is highly trusted, and the user experience is prioritized over security concerns(e.g. Mobile phones). Therefore, it is not recommended for use in public-facing applications or scenarios where sensitive data is involved.
〰️ Password Grant Type
🧪 Testing Password Grant Type with WSO2 IS
First, we need to create a Service Provider/Client in the WSO2 IS. To create a new service provider we can use the DCR we have discussed in the previous article.
Create a new service provider by executing the following cURL command.
curl -k -X POST -H "Authorization: Basic YWRtaW46YWRtaW4=" -H "Content-Type: application/json" -d '{"client_name": "playground_2","grant_types": ["authorization_code","password"], "redirect_uris": ["http://localhost:8080/playground2/oauth2client"],"ext_param_client_id":"provided_client_id0001","ext_param_client_secret":"provided_client_secret0001" }' "https://localhost:9443/api/identity/oauth2/dcr/v1.1/register"
Next, download the Apache Tomcat binary zip file and extract it to a location where you can access it easily on your machine. After that, download the playground2 sample application from WSO2 IS sample releases.
Then put the playground2.war file in the <TOMCAT_HOME>/webapps
directory and open a terminal in the <TOMCAT_HOME>/bin
directory. Then, run the following commands to extract the playground2.war file.
- If permissions are not set
↳chmod +x catalina.sh
- Start the Tomcat server
↳./catalina.sh start
After starting the Tomcat server, you will notice there is a directory created in <TOMCAT_HOME>/webapps
named playground2
. Stop the Tomcat server by typing ./catalina.shstop
and go to <TOMCAT_HOME>/webapps/playground2/WEB-INF/classes
and open playground2.properties
file. Then provide the Client ID and Client Secret for the playground2 app(When we created the Service Provider(SP) using DCR we gave provided_client_id0001
as the Client ID and provided_client_secret0001
as the Client Secret). After that, start the Tomcat server again by typing ./catalina.sh start
in the terminal.
If you want to see the logs of the Tomcat server, open another terminal tab and go to <TOMCAT_HOME>/logs
and type, tail -1000f catalina.out
Now, you can execute the following cURL command to get the Access Token.
- cURL format
↳curl -v -X POST --basic -u <CLIENT_ID>:<CLIENT_SECRET> -H "Content-Type:application/x-www-form-urlencoded;charset=UTF-8" -k -d "grant_type=password&scope=<SCOPES>&username=<USERNAME>&password=<PASSWORD>"https://localhost:9443/oauth2/token
- cURL example
↳curl -v -X POST --basic -u provided_client_id0001:provided_client_secret0001 -H "Content-Type:application/x-www-form-urlencoded;charset=UTF-8" -k -d "grant_type=password&scope=openid&username=admin&password=admin"https://localhost:9443/oauth2/token
Although we are requesting the /oauth2/token
endpoint, we are sending the request to the Authorization Server. Therefore, it will provide both Access and ID Tokens.
Now, you can use this Access Token to obtain user-info, by requesting to /oauth2/userinfo
endpoint.
- cURL format
↳curl -k -v -H "Authorization: Bearer <ACCESS_TOKEN>" https://localhost:9443/oauth2/userinfo
- cURL example
↳curl -k -v -H "Authorization: Bearer 3a81cb8c-e37c-36a1-b005-57a6760d354d" https://localhost:9443/oauth2/userinfo
Then, you can see the following output.
Alternatively, you can put the ID Token in https://jwt.io/ and get the user claim values as well.
As you can see, you are only getting the sub
value because we haven't configured what claims should be mapped to the SP and what claims should be mapped to the openid scope. You can check my previous articles on, how to create scopes and claim configuration to understand more about how you can get more claims using the /oauth2/userinfo
endpoint.
So this is it about the Password Grant Type. We will check about the Client Credentials Grant Type in the next article.
📚 References
- https://is.docs.wso2.com/en/latest/references/grant-types/#password-grant
- https://nipunaupeksha.hashnode.dev/oauth2-and-openid-connect-with-wso2-is-part-5
- https://nipunaupeksha.hashnode.dev/oauth2-and-openid-connect-with-wso2-is-part-6
- https://nipunaupeksha.medium.com/creating-custom-oidc-scopes-in-wso2-is-d8892e875273
- https://nipunaupeksha.medium.com/scopes-and-claim-management-in-wso2-is-dc845c119b84