2 Replies Latest reply on Jul 7, 2015 1:40 PM by nilsheuer

Obtaining tokens fails with 'access denied' message. Can someone help?

thundercat Jul 7, 2015 5:00 AM

Dear community,

I have difficulties obtaining tokens using OAuth (more precise: OAuth using Resource Owner Password Credentials Grant). I follow the tutorial at:

https://community.jivesoftware.com/docs/DOC-157031#jive_content_id_STEPS_4_5_Request_access_and_refresh_tokens_Receive_t…

I got stuck at Step 4/5: Request access and refresh tokens. I use curl to send the request, the response is every time:

{
     "error" : "access_denied",
     "error_description" : "No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken"
}

What am I doing wrong?
I am using the developer sandbox and uploaded my add-on there. I retrieved client id and client secret from the add-on page, as described. I double checked the client id, client secret, username and password in my curl call. Should all be correct.

I hope someone can help.

Best Regards, Mark

Re: Obtaining tokens fails with 'access denied' message. Can someone help?

nilsheuer Jul 7, 2015 1:39 PM (in response to thundercat)

IIRC the Resource Owner Password grant method does not work for federated users. As your sandbox user is federated this might be the cause for your error.

Generally, I would recommend to use the Authorization Code Grant method, as it does not require the user to share their credentials with your app.

While the Resource Owner Password approach is valid, it is not as widely used as the Auth Code approach. The OAuth documentation also recommends to only use it if you can fully trust the device the request is made from, which is really only valid for server to server applications (if at all).
Like (1)

Actions
- Re: Obtaining tokens fails with 'access denied' message. Can someone help?
  
  nilsheuer Jul 7, 2015 1:40 PM (in response to nilsheuer)
  
  Auth Code Grant will work with federated users in any case. The only restriction is that the Authorization dialog is not mobile friendly.
  1 person found this helpful
  
  Like (1)
  
  Actions

Go to original post

Incoming Links

Comment on 'How To Use OAuth 2.0 for REST API Calls'