OAuth ROPC Authentication with Escape¶

Description¶

The 'OAuth Resource Owner Password Credentials' preset implements the OAuth 2.0 Resource Owner Password Credentials grant type (RFC 6749, Section 4.3):

• Token Endpoint: Authentication requests are sent to the OAuth 2.0 authorization server's token endpoint to exchange user credentials for access tokens.
• Client Authentication: Uses client ID and client secret to authenticate the OAuth client application with the authorization server.
• Resource Owner Credentials: Directly uses the resource owner's (user's) username and password to obtain access tokens, bypassing the typical authorization code flow.
• Scope Support: Optional scope parameters can be included to request specific access permissions.

Important: This grant type should only be used when there is a high degree of trust between the resource owner and the client (e.g., first-party applications), as it involves handling user passwords directly. RFC 6749 recommends this flow only when other OAuth flows are not viable.

Examples¶

presets:
-   type: oauth_ropc
    url: https://oauth.example.com/token
    client_id: client123
    client_secret: secretXYZ
    users:
    -   username: user1
        password: pass1
    -   username: user2
        password: pass2
    -   username: user3
        password: pass3
        scopes:
        - create
        - delete

Extensive Configuration¶

Objects¶

OAuthROPCUserPreset¶