cloudfoundry / cloudfoundry/cf-java-client
Authorization header for uaa needs oauth2 encoding now
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 334
- Forks
- 319
- PR merge metrics
- No merged PRs in 30d
Description
UAA changes now to standard oauth encoding:
The RFC for OAuth requires an URL encode in authorization header, see
https://tools.ietf.org/html/rfc6749#section-2.3
The authorization header needs to be
Authorization: Basic base64Encode(urlencode(client_id):urlencode(client_secret))
UAAC does not encode the authorization header. (client)
UAA does not decode the authorization header (server)
Thus this issue does popup in uaac before, however uaac should behave standard conform.
This will come with UAA-RELEASE 74.0.0, see
https://www.pivotaltracker.com/n/projects/997278/stories/166970393
UAA clients need to be adapted, therefore this issue
Another example:
https://github.com/cloudfoundry/cf-uaac/issues/50
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the UAA token request and Authorization header construction in cf-java-client, then compare it with the RFC 6749 requirement and the referenced AbstractUaaTokenProvider.java example. Done means client credentials are URL-encoded before Base64 encoding and the client works with UAA-RELEASE 74.0.0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100