[QPID-8172] [Broker-J] OAuth2 authentication provider should not mandate setting of client secret

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: qpid-java-6.1.6, qpid-java-broker-7.0.3, qpid-java-6.0, qpid-java-6.1
• Fix Version/s: qpid-java-broker-7.1.0
• Component/s: Broker-J
• Assignee: Keith Wall
• Reporter: Alex Rudyy
• Created: 24/Apr/18 14:12
• Updated: 05/Jan/19 20:01
• Resolved: 15/May/18 07:43

Description

The current implementation of OAuth2 authentication provider requires specifying "client secret". However, the client secret can be an empty string and can even be omitted in the request if it is empty. As per RFC6749, section "2.3.1. Client Password":

client_secret
REQUIRED. The client secret. The client MAY omit the
parameter if the client secret is an empty string.

Thus, OAuth2 authentication provider should not mandate setting of client secret.