Closed awoie closed 5 months ago
RFC 6749 requires client_id in the token request if the client is not authenticated:
client_id
client_id REQUIRED, if the client is not authenticating with the authorization server as described in Section 3.2.1.
The pre-authz code example does not use client authentication and is therefore missing a client_id:
Below is a non-normative example of a Token Request in a Pre-Authorized Code Flow (without Client Authentication): POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code &pre-authorized_code=SplxlOBeZQQYbYS6WxSbIA &tx_code=493536
Below is a non-normative example of a Token Request in a Pre-Authorized Code Flow (without Client Authentication):
POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code &pre-authorized_code=SplxlOBeZQQYbYS6WxSbIA &tx_code=493536
The example should probably have to be fixed to include a client_id parameter (although it is pretty useless for pre-authz; more useful for code flow).
Closing issue since for pre-authz code this is not required if authorized_grant_anonymous_access_supported is set to true (default is false).
authorized_grant_anonymous_access_supported
true
false
RFC 6749 requires
client_id
in the token request if the client is not authenticated:The pre-authz code example does not use client authentication and is therefore missing a
client_id
:The example should probably have to be fixed to include a
client_id
parameter (although it is pretty useless for pre-authz; more useful for code flow).