Identity Server OAuth Resource Owner Password Grant always returns invalid_client

Question

new Client
{
    ClientId = "esmifavorito",
    ClientName = "esmifavorito-client",
    Enabled = true,
    ClientSecrets = new List<ClientSecret>
    {
        new ClientSecret("esmifavorito".Sha256()) //PQ/pIgjXnBfK67kOxGxz9Eykft6CKPkPewR3jUNEkZo=
    },

    Flow = Flows.ResourceOwner,

    //RequireConsent = false,
    //AllowRememberConsent = false,
    //ClientUri = "http",
    RedirectUris = new List<string>
    {
        "https://localhost:44304",
    },

    ScopeRestrictions = new List<string>
    {
    },

    AllowedCorsOrigins = new List<string> 
    {
        "https://localhost:44304",
        "http://localhost:50655",
        "chrome-extension://fdmmgilgnpjigdojojpjoooidkmcomcm",
        "*",
    },

    PostLogoutRedirectUris = new List<string>
    {
        "https://localhost:44304",
    },

    AccessTokenType = AccessTokenType.Jwt,
    IdentityTokenLifetime = 3000,
    AccessTokenLifetime = 3600,
    AuthorizationCodeLifetime = 300
}

I have registered my client, with implicit flow it works but I need to implement a login form so I'm trying Resource owner password credentials grant. I'm doing requests to the endpoint with Postman in Chrome (that's why I added the chrome-extension to CORS, just to see if that was the error...)

I've tried a lot of requests (using https)

POST /connect/token HTTP/1.1
Host: localhost:44302
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=test&password=testuser&client_id=esmifavorito

-

POST /connect/token HTTP/1.1
Host: localhost:44302
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=test&password=testuser&client_id=esmifavorito&client_secret=PQ%2FpIgjXnBfK67kOxGxz9Eykft6CKPkPewR3jUNEkZo%3D

-

POST /connect/token HTTP/1.1
Host: localhost:44302
Authorization: Basic ZXNtaWZhdm9yaXRvOlBRL3BJZ2pYbkJmSzY3a094R3h6OUV5a2Z0NkNLUGtQZXdSM2pVTkVrWm89
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=test&password=testuser

Those should have worked but I'm always getting invalid_client

The error log is empty, I don't know if I have done the tracer registration right

LogProvider.SetCurrentLogProvider(new DiagnosticsTraceLogProvider());
app.UseIdentityServer(new IdentityServerOptions
    {
        LoggingOptions = new LoggingOptions {
            IncludeSensitiveDataInLogs = true,
            WebApiDiagnosticsIsVerbose = true,
            EnableWebApiDiagnostics = true,
            //EnableHttpLogging = true
        },
        SiteName = "Thinktecture IdentityServer3 - UserService-AspNetIdentity",
        SigningCertificate = Certificate.Get(string.Format(@"{0}\bin\IdentityServer\IdentityServerEMFDev.pfx", AppDomain.CurrentDomain.BaseDirectory), "KG0yM0At"),
        Factory = idSvrFactory,
        CorsPolicy = CorsPolicy.AllowAll,
        AuthenticationOptions = new AuthenticationOptions
        {
            IdentityProviders = ConfigureAdditionalIdentityProviders,
        },
    }
);

With this in web.config

<trace autoflush="true"
       indentsize="4">
  <listeners>
    <add name="myListener"
         type="System.Diagnostics.TextWriterTraceListener"
         initializeData="Trace.log" />
    <remove name="Default" />
  </listeners>
</trace>

The client data is correct since I have succesfuly logged in with implicit flow. What am I missing? This is getting on my nerves, I'm reading the OAuth RFC and I don't see why this shouldn't work.

Answer 1

I tried the new version of Postman (I don't know its number, but now it runs on the desktop as a chrome app), I copied the values from the old Postman version and now everything works.

POST /connect/token HTTP/1.1
Host: localhost:44302
Authorization: Basic ZXNtaWZhdm9yaXRvOmVzbWlmYXZvcml0bw==
Cache-Control: no-cache
Postman-Token: fc4acc63-29f2-6a37-b92c-b62034b13c29
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=test&password=testuser&scope=write

This is the resulting request. In Postman 1 I have the same thing (excluding the Postman-Token) and it gives me invalid_client. I even used a similar Firefox tool with the same results. I don't know how is this possible. Could it be something with the chrome-extension://?

I'm gonna answer myself but if someone knows what is happening here I'll be eternally grateful.

Answer 2

In my case I had the same problem and I noticed it was due to my HttpClient setting a "custom" authorization header.

If using IdentityModel to request the resource owner password token, notice the Authorization header must contain client_id:client_secret in base 64.

In my case I was setting a different authorization header and, although the body values were correct, the IResourceOwnerPasswordValidator was not even attempting to validate the request.

Answer 3

It seems per this article that Authorization must be sent in the header

https://github.com/IdentityServer/IdentityServer3/issues/1520