Correct RFC 6749 implementation (fixes #145) #146
Conversation
Remove "scope" & "client_id" from "token request" in the "authorization code grant" flow, while keeping "client_id" in case the provider is one of the known to be broken ones.
|
I believe this PR also fixes #110 |
|
Hi, thanks for your contribution, but we don't use GitHub Pull Requests for code review. Can you please follow the instructions in our contribution guidelines? Thanks. |
|
@adg @plalloni What happen to this PR? Was it re-submited? |
|
@arvenil I don't think so. |
|
@plalloni I'm interested :) |
|
@plalloni need a hand to get this submitted? |
|
@plalloni ah, I forgot I can't submit for you. Have you completed the CLA? |
|
Allright, finally I've submitted https://go-review.googlesource.com/#/c/23790/. |
|
@josephholsten @arvenil @adg I've resubmitted this PR as http://golang.org/cl/23790/ as requested. |
|
@plalloni I think @josephholsten is referring to the google CLA, you need to sign this to submit code https://cla.developers.google.com/clas |
|
@drewwells @josephholsten, I did sign the CLA, almost a year ago. |
Work-arounds for using Salesforce as an OAuth identity provider. Do not send scope when exchanging authorization code for access token; Salesforce doesn't allow it. Include standard Salesforce endpoints in list of broken providers which require client_secret be sent when getting access token. See upstream issues: golang/oauth2#166 golang/oauth2#146
5 participants
Remove "scope" & "client_id" from "token request" in the
"authorization code grant" flow, while keeping "client_id"
in case the provider is one of the known to be broken ones.
This PR fixes #145