Add password grant endpoint

This is a fantastic patch! Thank you Ed.

I have some nit picks:

1. +++ b/simple_oauth.routing.yml
   @@ -117,3 +117,11 @@ access_token.refresh:
   +    _access: 'TRUE'
   

   I always forget, is this supposed to be TRUE or 'TRUE'?

2. +++ b/src/Controller/AccessTokenIssue.php
   @@ -0,0 +1,115 @@
   +    $body = json_decode($request->getContent());
   

   Json::decode(…)

3. +++ b/src/Controller/AccessTokenIssue.php
   @@ -0,0 +1,115 @@
   +      $this->response->setStatusCode(422);
   

   We should throw an HttpException instead. This is out of the scope of this issue, but … could you create a follow up for someone else to take on?

4. +++ b/src/Controller/AccessTokenIssue.php
   @@ -0,0 +1,115 @@
   +    } else {
   

   DCS: else in the next line.

5. +++ b/src/Controller/AccessTokenIssue.php
   @@ -0,0 +1,115 @@
   +  protected function normalize(AccessToken $token) {
   

   This needs a docblock.

I'm good with this feature request, but we need to figure out a way to make people understand that they can't allow 3rd parties to use this endpoint.

I do not think we can enforce this behavior from the server. We should add some big red signs explaining what this endpoint is used for.

Maybe this endpoint could respond with an error until the admin goes to the UI and "enables" it with a confirmation form.

Context:

The Password grant is used when the application exchanges the user’s username and password for an access token. This is exactly the thing OAuth was created to prevent in the first place, so you should never allow third-party apps to use this grant.

A common use for this grant type is to enable password logins for your service’s own apps. Users won’t be surprised to log in to the service’s website or native application using their username and password, but third-party apps should never be allowed to ask the user for their password.

Yes. That tweet was about the version 8.x-2.x. However, I still think this issue has a lot of merit for 8.x-1.x so if you address the existing nit picks it would be fantastic.

On second read I don't think that we need anything extra regarding:

We should add some big red signs explaining what this endpoint is used for.

Hi !

I gave this patch a try. However, I stumble on a HTTP error 500 when sending a POST on /simple-oauth. The apache logs reveals a dependency injection issue :

[Fri Nov 25 11:16:21.545541 2016] [proxy_fcgi:error] [pid 1291:tid 140214777378560] [client 192.168.88.1:49281] AH01071: Got error 'PHP message: Uncaught PHP Exception InvalidArgumentException: "Class "Drupal\\simple_oauth\\Controller\\AccessTokenIssue" does not exist." at /var/www/drupalvm/drupal/web/core/lib/Drupal/Core/DependencyInjection/ClassResolver.php line 24\n'

I'm totally newbie on Drupal/PHP and I can't see what is causing this issue. For info, a POST on /simple-oauth/refresh works fine.

Would you have any clue about this ?

Thanks !

Just for information, I retried and realized I haven't reloaded Drupal cache (drush cache-reload). The route was not properly registered, leading to the 500 error. With the reload, it now works !

Added some modifications before merging. Thanks @ef4!