client_secret like "Abc123++" get token failed

[funs690]

ClientSecretBasicAuthenticationConverter line 88-89
"Abc123++" after URLDecoder.decode change to "Abc123 "

###############
Basic Authentication set client_id and client_secret in the header. So no need to URLDecoder.decode again!

[sjohnr]

Hi @funs690. The converter is implemented to spec, per RFC 6749, Section 2.3.1. You can provide your own converter if you wish to deviate from the url encoding/decoding specified by the spec. For example:

OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
		new OAuth2AuthorizationServerConfigurer<>();
authorizationServerConfigurer.clientAuthentication(clientAuthentication -> clientAuthentication
		.authenticationConverter(new MyClientSecretBasicAuthenticationConverter()));

If you are interested in learning more about customizing client authentication, please up-vote #540, as we are currently prioritizing what guides we work on for our reference documentation based on community feedback.

I'm going to close this issue, as the implementation is working according to the specification.

[shmonika]

.authenticationConverter

Hi @sjohnr, I am facing the same issue and I tried to implement my own AuthenticationConverter with the changes as you suggested

    @Bean
    @Order(HIGHEST_PRECEDENCE)
    fun defaultSecurityFilterChain(http: HttpSecurity): SecurityFilterChain {
        val authorizationServerConfigurer = OAuth2AuthorizationServerConfigurer<HttpSecurity>()
            .clientAuthentication { clientAuthentication: OAuth2ClientAuthenticationConfigurer ->
                clientAuthentication.authenticationConverter(CustomClientSecretBasicAuthenticationConverter())
            }

        http.authorizeRequests { authorizeRequests ->
            authorizeRequests.antMatchers(
                ACTUATOR_PATH,
                TOKEN_VALIDATION_PATH
            ).permitAll()
            authorizeRequests.anyRequest().authenticated()
        }.apply(authorizationServerConfigurer)
        return http.build()
    }

However, it always defaults to ClientSecretBasicAuthenticationConverter.
Any feedback on this is appreciated. Thanks!

[sjohnr]

@shmonika, did you intend to put this code in the defaultSecurityFilterChain() method? In our samples, there are two filter chains, and the one you want to be modifying would be authorizationServerSecurityFilterChain().

[shmonika]

@shmonika, did you intend to put this code in the defaultSecurityFilterChain() method? In our samples, there are two filter chains, and the one you want to be modifying would be authorizationServerSecurityFilterChain().

@sjohnr Yeah, that was it. Thank you for your quick response :)