If I try to use oauth2c for a device flow, and I don't have a client-secret, it seems to fail because it doesn't send the client_id in the /token request. There's no requirement that device-flow users present a secret when they get the token, but they do need to present the client_id when getting the token. Oauth2c only puts the device_code and grant_type in the /token response, so I get rejected by the server with an "Invalid client" error after a 5-second wait.
❯ oauth2c https://[redacted] --client-id [redacted] --grant-type urn:ietf:params:oauth:grant-type:device_code --callback-addr 0.0.0.0:8000 --redirect-url http://localhost:8000 --no-browser --scopes=openid,email,profile,roles
┌───────────────────────────────────────────────────────────┐
| Issuer URL | https://[redacted] |
| Grant type | urn:ietf:params:oauth:grant-type:device_code |
| Scopes | openid, email, profile, roles |
| PKCE | false |
| Client ID | [redacted] |
└───────────────────────────────────────────────────────────┘
Device Flow
# Request device authorization
POST https://[redacted]/protocol/openid-connect/auth/device
Headers:
Content-Type: application/x-www-form-urlencoded
Form post:
client_id: [redacted]
scope: openid email profile roles
Response:
{
"device_code": "[redacted]",
"user_code": "CVJZ-CTKL",
"verification_uri": "https://[redacted]/device",
"verification_uri_complete": "https://[redacted]/device?user_code=CVJZ-CTKL",
"expires_in": 600,
"interval": 5
}
Go to the following URL:
https://[redacted]/device?user_code=CVJZ-CTKL
# Exchange device code for token
POST https://[redacted]/protocol/openid-connect/token
Headers:
Content-Type: application/x-www-form-urlencoded
Form post:
device_code: [redacted]
grant_type: urn:ietf:params:oauth:grant-type:device_code
Response:
{
"error": "invalid_client",
"error_description": "Invalid client or Invalid client credentials"
}
ERROR 401: invalid_client
That last Form post should have had a client_id in! Presumably your demo works because that has a client secret and uses basic-auth, so it gets set here but the client ID isn't used in that function otherwise.
If I try to use oauth2c for a device flow, and I don't have a client-secret, it seems to fail because it doesn't send the
client_idin the/tokenrequest. There's no requirement that device-flow users present a secret when they get the token, but they do need to present the client_id when getting the token. Oauth2c only puts thedevice_codeandgrant_typein the/tokenresponse, so I get rejected by the server with an "Invalid client" error after a 5-second wait.That last
Form postshould have had a client_id in! Presumably your demo works because that has a client secret and uses basic-auth, so it gets set here but the client ID isn't used in that function otherwise.