Merge pull request #346 from chainlink/client-secret-flag-password-grant

Make client_secret optional for password grant type

Author: mjsalinger

lib/handlers/token-handler.js

@@ -60,6 +60,7 @@ function TokenHandler(options) {
   this.model = options.model;
   this.refreshTokenLifetime = options.refreshTokenLifetime;
   this.allowExtendedTokenAttributes = options.allowExtendedTokenAttributes;
+  this.requiresClientAuthentication = options.requiresClientAuthentication || {};
   this.alwaysIssueNewRefreshToken = options.alwaysIssueNewRefreshToken !== false;
 }
 
@@ -113,12 +114,13 @@ TokenHandler.prototype.handle = function(request, response) {
 
 TokenHandler.prototype.getClient = function(request, response) {
   var credentials = this.getClientCredentials(request);
+  var grantType = request.body.grant_type;
 
   if (!credentials.clientId) {
     throw new InvalidRequestError('Missing parameter: `client_id`');
   }
 
-  if (!credentials.clientSecret) {
+  if (this.isClientAuthenticationRequired(grantType) && !credentials.clientSecret) {
     throw new InvalidRequestError('Missing parameter: `client_secret`');
   }
 
@@ -172,6 +174,7 @@ TokenHandler.prototype.getClient = function(request, response) {
 
 TokenHandler.prototype.getClientCredentials = function(request) {
   var credentials = auth(request);
+  var grantType = request.body.grant_type;
 
   if (credentials) {
     return { clientId: credentials.name, clientSecret: credentials.pass };
@@ -181,6 +184,12 @@ TokenHandler.prototype.getClientCredentials = function(request) {
     return { clientId: request.body.client_id, clientSecret: request.body.client_secret };
   }
 
+  if (!this.isClientAuthenticationRequired(grantType)) {
+    if(request.body.client_id) {
+      return { clientId: request.body.client_id };
+    }
+  }
+
   throw new InvalidClientError('Invalid client: cannot retrieve client credentials');
 };
 
@@ -270,6 +279,17 @@ TokenHandler.prototype.updateErrorResponse = function(response, error) {
   response.status = error.code;
 };
 
+/**
+ * Given a grant type, check if client authentication is required
+ */
+TokenHandler.prototype.isClientAuthenticationRequired = function(grantType) {
+  if(Object.keys(this.requiresClientAuthentication).length > 0) {
+    return (typeof this.requiresClientAuthentication[grantType] !== 'undefined') ? this.requiresClientAuthentication[grantType] : true;
+  } else {
+    return true;
+  }
+};
+
 /**
  * Export constructor.
  */

lib/server.js

@@ -63,7 +63,8 @@ OAuth2Server.prototype.token = function(request, response, options, callback) {
   options = _.assign({
     accessTokenLifetime: 60 * 60,             // 1 hour.
     refreshTokenLifetime: 60 * 60 * 24 * 14,  // 2 weeks.
-    allowExtendedTokenAttributes: false
+    allowExtendedTokenAttributes: false,
+    requiresClientAuthentication: {}          //defaults to true for all grant types
   }, this.options, options);
 
   return new TokenHandler(options)

test/integration/handlers/token-handler_test.js

@@ -419,7 +419,7 @@ describe('TokenHandler integration', function() {
       }
     });
 
-    it('should throw an error if `clientId` is invalid', function() {
+    it('should throw an error if `clientSecret` is invalid', function() {
       var model = {
         getClient: function() {},
         saveToken: function() {}
@@ -526,6 +526,33 @@ describe('TokenHandler integration', function() {
         .catch(should.fail);
     });
 
+    describe('with `password` grant type and `requiresClientAuthentication` is false', function() {
+
+      it('should return a client ', function() {
+        var client = { id: 12345, grants: [] };
+        var model = {
+          getClient: function() { return client; },
+          saveToken: function() {}
+        };
+
+        var handler = new TokenHandler({
+          accessTokenLifetime: 120,
+          model: model,
+          refreshTokenLifetime: 120,
+          requiresClientAuthentication: {
+            password: false
+          }
+       });
+        var request = new Request({ body: { client_id: 'blah', grant_type: 'password'}, headers: {}, method: {}, query: {} });
+
+        return handler.getClient(request)
+          .then(function(data) {
+            data.should.equal(client);
+          })
+          .catch(should.fail);
+      });
+    });
+
     it('should support promises', function() {
       var model = {
         getClient: function() { return Promise.resolve({ grants: [] }); },
@@ -597,6 +624,20 @@ describe('TokenHandler integration', function() {
       }
     });
 
+    describe('with `client_id` and grant type is `password` and `requiresClientAuthentication` is false', function() {
+      it('should return a client', function() {
+        var model = {
+          getClient: function() {},
+          saveToken: function() {}
+        };
+        var handler = new TokenHandler({ accessTokenLifetime: 120, model: model, refreshTokenLifetime: 120, requiresClientAuthentication: { password: false} });
+        var request = new Request({ body: { client_id: 'foo', grant_type: 'password' }, headers: {}, method: {}, query: {} });
+        var credentials = handler.getClientCredentials(request);
+
+        credentials.should.eql({ clientId: 'foo' });
+      });
+    });
+
     describe('with `client_id` and `client_secret` in the request header as basic auth', function() {
       it('should return a client', function() {
         var model = {