Summary
When I try to configure my Spring Boot application to perform OAuth2 authentication using the password grant-type I get the following exception:
java.lang.IllegalArgumentException: Invalid Authorization Grant Type (password) for Client Registration with Id: SFX
Actual Behavior
I am building a REST API that connects to another REST API that implements OAuth2 authentication (in this particular scenario it is Salesforce API). The REST API I am building will never interact directly with the user so I cannot use the authorization code grant type to perform authentication/ Therefore, I had to opt for the password grant type. However, it seems that support for this was not fully implemented. Is there a reason why this was not implemented? Am I approaching the problem correclty please?
Comment From: jgrandja
@samanthacatania The password grant was added in 5.2.0 release. See the reference doc and this sample.
You are using a pre 5.2 version if you're getting that error message.
Comment From: samanthacatania
Thanks for pointing me in the right direction. One further question, I noticed that in the sample the reactive WebClient is used. Are you aware if the current implementation is compatible with any other clients please?
Comment From: jgrandja
Are you aware if the current implementation is compatible with any other clients please?
At the moment, WebClient is the only HTTP Client supported by Spring Security 5.2 via ServletOAuth2AuthorizedClientExchangeFilterFunction and ServerOAuth2AuthorizedClientExchangeFilterFunction (reactive).
However, you may use OAuth2AuthorizedClientManager (or ReactiveOAuth2AuthorizedClientManager) in collaboration with any HTTP Client of your choosing. All you need is the access token to use with an HTTP Client and that is provided to you by OAuth2AuthorizedClientManager, which provides OAuth2AuthorizedClient's and is associated with OAuth2AuthorizedClient.getAccessToken().
See the ref doc for OAuth2AuthorizedClientManager.