{"action":"created","issue":{"url":"https://api.github.com/repos/Mashape/kong/issues/620","labels_url":"https://api.github.com/repos/Mashape/kong/issues/620/labels{/name}","comments_url":"https://api.github.com/repos/Mashape/kong/issues/620/comments","events_url":"https://api.github.com/repos/Mashape/kong/issues/620/events","html_url":"https://github.com/Mashape/kong/issues/620","id":111295421,"number":620,"title":"Oauth2 - resource owner password credentials endpoint","user":{"login":"PGBI","id":6191583,"avatar_url":"https://avatars.githubusercontent.com/u/6191583?v=3","gravatar_id":"","url":"https://api.github.com/users/PGBI","html_url":"https://github.com/PGBI","followers_url":"https://api.github.com/users/PGBI/followers","following_url":"https://api.github.com/users/PGBI/following{/other_user}","gists_url":"https://api.github.com/users/PGBI/gists{/gist_id}","starred_url":"https://api.github.com/users/PGBI/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PGBI/subscriptions","organizations_url":"https://api.github.com/users/PGBI/orgs","repos_url":"https://api.github.com/users/PGBI/repos","events_url":"https://api.github.com/users/PGBI/events{/privacy}","received_events_url":"https://api.github.com/users/PGBI/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Mashape/kong/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"thefosk","id":964813,"avatar_url":"https://avatars.githubusercontent.com/u/964813?v=3","gravatar_id":"","url":"https://api.github.com/users/thefosk","html_url":"https://github.com/thefosk","followers_url":"https://api.github.com/users/thefosk/followers","following_url":"https://api.github.com/users/thefosk/following{/other_user}","gists_url":"https://api.github.com/users/thefosk/gists{/gist_id}","starred_url":"https://api.github.com/users/thefosk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thefosk/subscriptions","organizations_url":"https://api.github.com/users/thefosk/orgs","repos_url":"https://api.github.com/users/thefosk/repos","events_url":"https://api.github.com/users/thefosk/events{/privacy}","received_events_url":"https://api.github.com/users/thefosk/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-10-13T23:54:13Z","updated_at":"2015-10-14T00:40:07Z","closed_at":null,"body":"Hi, this is more a question than an issue (I guess). I'm trying to implement the \"resource owner password credentials\" oauth2 flow for my API using Kong. If I understand correctly, when the client is making a request to get a user access tokens, it has to make a request to `POST /oauth2/token` with the following information:\r\n- client_id,\r\n- client_secret,\r\n- username,\r\n- password.\r\n- grant_type = password\r\n\r\nBut by doing so, kong is intercepting the request (and throws an error since there is no provisioning_key the client doesn't know about). So my API can't authenticate the user and add user_id and provisioning_key to the headers.\r\n\r\nI guess there is something I'm missing here."},"comment":{"url":"https://api.github.com/repos/Mashape/kong/issues/comments/147892586","html_url":"https://github.com/Mashape/kong/issues/620#issuecomment-147892586","issue_url":"https://api.github.com/repos/Mashape/kong/issues/620","id":147892586,"user":{"login":"thefosk","id":964813,"avatar_url":"https://avatars.githubusercontent.com/u/964813?v=3","gravatar_id":"","url":"https://api.github.com/users/thefosk","html_url":"https://github.com/thefosk","followers_url":"https://api.github.com/users/thefosk/followers","following_url":"https://api.github.com/users/thefosk/following{/other_user}","gists_url":"https://api.github.com/users/thefosk/gists{/gist_id}","starred_url":"https://api.github.com/users/thefosk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thefosk/subscriptions","organizations_url":"https://api.github.com/users/thefosk/orgs","repos_url":"https://api.github.com/users/thefosk/repos","events_url":"https://api.github.com/users/thefosk/events{/privacy}","received_events_url":"https://api.github.com/users/thefosk/received_events","type":"User","site_admin":false},"created_at":"2015-10-14T00:40:07Z","updated_at":"2015-10-14T00:40:07Z","body":"@PGBI the user will communicate with your server first, you will show the authentication page, and then if the authentication is successful your system will talk with Kong (`POST /oauth2/token`), and return the response to the user.\r\n\r\nThe user has to hit your server first because, as you figured out, there would be no way for Kong to know if the user is authenticated."}}