puppetlabs / vault-plugin-secrets-oauthapp

OAuth 2.0 secrets plugin for HashiCorp Vault supporting a variety of grant types
Apache License 2.0
94 stars 10 forks source link

Support for client credentials grant type #19

Closed ceecko closed 3 years ago

ceecko commented 3 years ago

This PR adds support for a client credentials grant type, also known as 2-legged OAuth.

The Client Credentials grant type is used by clients to obtain an access token outside of the context of a user. This is typically used by clients to access resources about themselves rather than to access a user's resources.

Main changes:

Any feedback is highly appreciated.

ceecko commented 3 years ago

On second thought I don't think the client credentials grant matches the scope of this plugin. I don't like the way it is integrated and covered by tests either.

It makes more sense to create a standalone plugin just for the client credentials grant type. Closing this pull request.

impl commented 3 years ago

Hey @ceecko,

Not sure if this is still of interest to you, but we needed to implement client creds flow (done in #30) for one of our own projects; details of usage are in the README at https://github.com/puppetlabs/vault-plugin-secrets-oauthapp/blob/master/README.md#client-credentials-flow. We took a slightly different approach than your PR as it's conceivable that you'd want to do both client creds and auth code exchange for the same underlying client ID/secret pair.

ceecko commented 3 years ago

@impl Thank you for the heads up. This is very welcome! In the meantime we have implemented our own plugin at https://github.com/evennode/vault-plugin-secrets-oauth-client-credentials specifically for client credentials grant. It may make more sense to use just one plugin though. Thank you for letting me know.