Problem/Motivation

Microsoft requires the token request includes the resource the token will be used for, see https://stackoverflow.com/questions/23921884/what-is-the-resource-parame...

However, there is currently no option to add a resource parameter to the OAuth2 Client.

Proposed resolution

Allow requesting tokens for a resource that differs from the token endpoint.

Remaining tasks

  1. Write a patch
  2. Review
  3. Commit

User interface changes

None.

API changes

hook_oauth2_clients() has a new option resource

Data model changes

None.

CommentFileSizeAuthor
#2 3175811-2.patch1.47 KBidebr

Comments

idebr created an issue. See original summary.

idebr’s picture

idebr commented
Status: Active » Needs review
StatusFileSize
new 3175811-2.patch1.47 KB

Attached patch implements a new parameter resource that allows the authorization and token requests to specify a resource that differs from the token endpoint.

dashohoxha’s picture

dashohoxha commented

Is this a standard feature of the OAuth2 protocol? If yes, then it makes sense to apply this patch.
Otherwise, if this is a feature implemented only by the Microsoft servers, and no one else, it makes more sense to implement it as an extension of the module.
For more details see the docs: https://www.drupal.org/docs/8/modules/oauth2-client/oauth2-client-7x-2x#...

idebr’s picture

idebr commented

#3 Yes, resource is a part of the oauth2 specification. It is implemented in the D8 version as resource_owner_uri in the plugin annotation.

dashohoxha’s picture

dashohoxha commented

It seems that you are right: https://tools.ietf.org/html/rfc8707

  • dashohoxha committed 3a3d059 on 7.x-2.x authored by idebr 
    Issue #3175811 by idebr: Allow requesting tokens for a resource that...
dashohoxha’s picture

dashohoxha commented
Status: Needs review » Fixed

Thanks @idebr for reporting it and for the patch.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.