{"id":18969702,"url":"https://github.com/mefarazath/authorization-grant-without-client-secret","last_synced_at":"2026-04-05T23:30:15.713Z","repository":{"id":73213218,"uuid":"106913429","full_name":"mefarazath/Authorization-Grant-Without-Client-Secret","owner":"mefarazath","description":"Extensions and configurations required to enable authorization code grant without client secret with WSO2 Identity Server","archived":false,"fork":false,"pushed_at":"2020-04-20T10:48:23.000Z","size":16,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-01T07:24:02.671Z","etag":null,"topics":["authorization-flow","oauth2","wso2-identity-server"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mefarazath.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-10-14T08:59:46.000Z","updated_at":"2020-04-20T10:48:25.000Z","dependencies_parsed_at":null,"dependency_job_id":"264f4cb3-bf28-48cd-b7a2-c138859cd874","html_url":"https://github.com/mefarazath/Authorization-Grant-Without-Client-Secret","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mefarazath%2FAuthorization-Grant-Without-Client-Secret","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mefarazath%2FAuthorization-Grant-Without-Client-Secret/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mefarazath%2FAuthorization-Grant-Without-Client-Secret/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mefarazath%2FAuthorization-Grant-Without-Client-Secret/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mefarazath","download_url":"https://codeload.github.com/mefarazath/Authorization-Grant-Without-Client-Secret/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239968416,"owners_count":19726687,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization-flow","oauth2","wso2-identity-server"],"created_at":"2024-11-08T14:53:52.194Z","updated_at":"2026-04-05T23:30:15.669Z","avatar_url":"https://github.com/mefarazath.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1\u003eAuthorization Grant without Client Secret\u003c/h1\u003e\n\nThis approach is only required for WSO2 Identity Server 5.6.0 and older versions.\n\nFor IS 5.7.0 above you can simply enable the 'Allow authentication without the client secret' option in the OAuth2 configurations (ie. you can skip steps 1 to 3). (https://docs.wso2.com/display/IS570/Configuring+OAuth2-OpenID+Connect+Single-Sign-On). \n\nThis repo contains artifacts and configurations required to use authorization grant flow without client_secret for public clients.\n\nDownload WSO2 Identity Server at https://wso2.com/identity-and-access-management or for the latest milestone go to https://github.com/wso2/product-is/releases\n\nSteps to try out,\n\n1. Build the jar and place it in WSO2_HOME/repository/components/lib\nThis jar contains two extension classes\n    1. ExtendedAuthzGrantValidator --\u003e Removes the strict client validation requirement for authorization code grant.\n     Configuration involved explained in step #2\n    2. ExtendedBasicAuthClientHandler -\u003e Overrides the default behaviour of strict client authentication for \n    authorization grant. Configuration involved explained in step #3\n\n2. - Override the default grant validator for Authorization Code Grant type. The default validator enforces client \nauthentication and we need to get rid of that.\n\n````\n\u003cOAuth\u003e\n       ....\n     \u003cSupportedGrantTypes\u003e\n                \u003cSupportedGrantType\u003e\n                    \u003cGrantTypeName\u003eauthorization_code\u003c/GrantTypeName\u003e\n                    \u003cGrantTypeHandlerImplClass\u003eorg.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationCodeGrantHandler\u003c/GrantTypeHandlerImplClass\u003e\n                    \u003cGrantTypeValidatorImplClass\u003eorg.wso2.carbon.identity.oauth2.grant.validator.ExtendedAuthzGrantValidator\u003c/GrantTypeValidatorImplClass\u003e\n                \u003c/SupportedGrantType\u003e\n     \u003c/SupportedGrantTypes\u003e\n      ....\n\u003c/OAuth\u003e\n````\n\n3. Change the WSO2_HOME/repository/conf/identity/identity.xml as follows.\n````\n\u003cOAuth\u003e\n   ....\n       \u003cClientAuthHandlers\u003e\n            \u003c!--ClientAuthHandler Class=\"org.wso2.carbon.identity.oauth2.token.handlers.clientauth.BasicAuthClientAuthHandler\"\u003e\n                \u003cProperty Name=\"StrictClientCredentialValidation\"\u003efalse\u003c/Property\u003e\n            \u003c/ClientAuthHandler--\u003e\n            \u003cClientAuthHandler Class=\"org.wso2.carbon.identity.oauth2.client.auth.handler.ExtendedBasicAuthClientHandler\"\u003e\n                \u003cProperty Name=\"StrictClientCredentialValidation\"\u003efalse\u003c/Property\u003e\n                \u003cProperty Name=\"StrictClientCredentialValidationForAuthzCodeGrant\"\u003efalse\u003c/Property\u003e\n            \u003c/ClientAuthHandler\u003e\n        \u003c/ClientAuthHandlers\u003e\n    ....\n\u003c/OAuth\u003e\n````\n\n\n4. Startup the server\n\n5. Create an oauth application\n````\ncurl -k -X POST https://localhost:9443/identity/connect/register -H 'authorization: Basic YWRtaW46YWRtaW4=' -H 'content-type: application/json' -d '{\"redirect_uris\": [\"https://localhost/callback\"],\"client_name\": \"authz_code_test\",\"ext_param_owner\": \"application_owner\",\"grant_types\": [\"authorization_code password client_credentials\"]}'\n````\nResponse:\n````\n{\"grant_types\":[\"authorization_code\",\"password\",\"client_credentials\"],\"client_secret_expires_at\":\"0\",\"redirect_uris\":[\"https:\\/\\/localhost\\/callback\"],\"client_secret\":\"bhf5pVEKOwwMhwyGLJ1mz70mQdYa\",\"client_name\":\"admin_authz_code_test\",\"client_id\":\"XALwgcRGsR4zud4RsokMmtNm3xQa\"}\n````\n\n6. Get an authorization code,\n(Refer: https://farasath.blogspot.com/2017/10/oauth2-authorization-code-flow-without.html you can skip the Service Provider \ncreation part)\n````\nhttps://localhost:9443/oauth2/authorize?response_type=code\u0026client_id=XALwgcRGsR4zud4RsokMmtNm3xQa\u0026redirect_uri=https://localhost/callback\u0026scope=read\n````\n\nResponse After authentication and consent\n````\nhttps://localhost/callback?code=2cb973ea-50de-3dc9-91af-ef4b1978a80f\n````\n\n7. Get the access token (Note: we don't sent client secret in the authorization header. Instead we only sent clien_id\n as a request param)\n````\ncurl -k -v -d \"grant_type=authorization_code\u0026code=2cb973ea-50de-3dc9-91af-ef4b1978a80f\u0026redirect_uri=https://localhost/callback\u0026client_id=XALwgcRGsR4zud4RsokMmtNm3xQa\" https://localhost:9443/oauth2/token \n````\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmefarazath%2Fauthorization-grant-without-client-secret","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmefarazath%2Fauthorization-grant-without-client-secret","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmefarazath%2Fauthorization-grant-without-client-secret/lists"}