Add Client Credentials Grant flow

[oshliaer]

I'd like add Client Credentials Grant flow

STANDARD

https://tools.ietf.org/html/rfc6749#section-4.4

An implementation

#81 (comment)

[larrybotha]

Twitter's app-only authentication also requires grant_type

[oshliaer]

@larrybotha ,

Thanks!

Does It require oAuth2? Sorry, I didn't use Twitter API yet.
Look at the commit bottom for the new example 👇

[larrybotha]

haha ye - I spent a couple hours wondering why I couldn't get a user account to authenticate with Twitter, only to realise they use OAuth1 for user authentication, and OAuth2 for app-only authentication.

Your commit looks good - assuming grant_type=client_credentials is added to the body of the request, which is what Twitter expects for app-only auth. I'm still new to HTTP, so I'm not really sure if setting params is the equivalent to defining the payload... I thought they were different things.

[oshliaer]

I thought they were different things.

I thought so. I tried to be consistent.

The Explanation

The default setup the way of the main flow https://github.com/oshliaer/apps-script-oauth2/blob/add-client-credentials-grant-flow/src/Service.gs#L323-L325

if (token && token.refresh_token) {
  try {
    this.refresh();

...

Service_.prototype.refresh = function() {
  grant_type: 'refresh_token'

I add the ability to choose a new path (a switcher) https://github.com/oshliaer/apps-script-oauth2/blob/add-client-credentials-grant-flow/src/Service.gs#L337-L339

} else if (this.params_.grant_type === 'client_credentials'){
  try {
    this.requestCCG_();

...

Service_.prototype.requestCCG_ = function() {
  grant_type: 'client_credentials'

Another way

@larrybotha I can create another option. Require the user to enter the application key. For app-only authentication. Like this

OAuth2.createService(serviceName)
  .setTokenUrl(tokenUrl)
  .setAppId(appId)
  .setAppSecret(appSecret)

Will this be more correct? But even Twitter doesn't distinguish between the clientId and the appId. There are Consumer Key (API Key) and Consumer Secret (API Secret) only.

The Conclusion

Perhaps it needs to be a more transparent implementation? Or more unambiguous?
@erickoledadevrel

[bigben386]

Any idea when this may get added? I am trying to use this with Centrify which also uses the client credentials flow https://developer.centrify.com/docs/client-credentials-flow

[oshliaer]

@bigben386 , It seems they want you to set an Authorization header on access token requests.
Please, look at Advanced configuration for this.
This part of the code still works fine but you have to resolve conflicts in the repo yourself.

[bigben386]

I am using the authorization header. This is my code

function getCentrifyService(){ return OAuth2.createService('Centrify') .setTokenUrl(TOKEN_URL) .setClientId(CLIENT_ID) .setScope(SCOPE) .setClientSecret(CLIENT_SECRET) .setPropertyStore(PropertiesService.getScriptProperties()) .setTokenHeaders({ 'Authorization': 'Basic ' + Utilities.base64Encode(CLIENT_ID + ':' + CLIENT_SECRET) }); }

I am not getting a token when running getAccessToken(). I get "Error: Access not granted or expired. (line 413, file "Service", project "OAuth2")"

I am using these exact settings in Postman with oauth2 client credentials grant type and do not have any issues. Maybe I am missing something obvious. Any help is appreciated.