OAuth2 client credentials grant

[bruno-villa]

Hello,

I'm using dex with an AD connector to test authentication of users and services. The implicit and authorization flows work as expected and that can handle users. For services I would like to use the client credentials grant. Unfortunately, this does not seem to work out of the box:

curl -X POST -H 'content-type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id=myapp&client_secret=mysecret&scope=groups' https://mydex/token
curl -X POST  --user myapp:mysecret -d '{"grant_type":"client_credentials"}' https://mydex/token

Both return an error 400 invalid grant. I was not able to find relevant documentation regarding the configuration of dex. There are related issues (#1668 and #764) but these are either outdated or inconclusive. So my question is: are client credentials supported or are they not in scope (since I understand they are technically not OIDC)?

[nabokihms]

In Dex's current state, the client credentials grant is not supported.
There was a PR #1629, but we haven't reviewed it yet.

[bruno-villa]

Thank you for the quick reply. I had not come across that PR. Hopefully it can be reviewed and merged.

[sagikazarmark]

@bruno-villa note that the linked PR doesn't federate identities. Client credentials will give you an access token to a specific user and thus it's a bit orthogonal to the Dex use case (which is why we haven't implemented it yet).

[bruno-villa]

Thank you for the clarification. For my use case of authenticating a specific service I think this would be sufficient.