{"action":"opened","issue":{"url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/99","labels_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/99/labels{/name}","comments_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/99/comments","events_url":"https://api.github.com/repos/zfcampus/zf-mvc-auth/issues/99/events","html_url":"https://github.com/zfcampus/zf-mvc-auth/issues/99","id":102191570,"number":99,"title":"Empty response when bad oauth2 credentials supplied (e.g. expired access token)","user":{"login":"dorongutman","id":719298,"avatar_url":"https://avatars.githubusercontent.com/u/719298?v=3","gravatar_id":"","url":"https://api.github.com/users/dorongutman","html_url":"https://github.com/dorongutman","followers_url":"https://api.github.com/users/dorongutman/followers","following_url":"https://api.github.com/users/dorongutman/following{/other_user}","gists_url":"https://api.github.com/users/dorongutman/gists{/gist_id}","starred_url":"https://api.github.com/users/dorongutman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dorongutman/subscriptions","organizations_url":"https://api.github.com/users/dorongutman/orgs","repos_url":"https://api.github.com/users/dorongutman/repos","events_url":"https://api.github.com/users/dorongutman/events{/privacy}","received_events_url":"https://api.github.com/users/dorongutman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-20T17:40:48Z","updated_at":"2015-08-20T17:40:48Z","closed_at":null,"body":"In the authenticate method of the oauth2 adapter (https://github.com/zfcampus/zf-mvc-auth/blob/master/src/Authentication/OAuth2Adapter.php#L135) - if the response is an IdentityInterface, the output is a json that looks like this (due to the SendApiProblemResponseListener, which parses the ApiProblem response which is generated later on):\r\n\r\n```json\r\n{\r\n  \"type\": \"http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html\",\r\n  \"title\": \"Forbidden\",\r\n  \"status\": 403,\r\n  \"detail\": \"Forbidden\"\r\n}\r\n```\r\n\r\nHowever - in the case of an error from the response of the oauth2 server (https://github.com/zfcampus/zf-mvc-auth/blob/master/src/Authentication/OAuth2Adapter.php#L154-L156), what returns is a Zend\\Http\\Response, causing the response to be an empty response with only the 401 status code but without a body (https://github.com/zfcampus/zf-mvc-auth/blob/master/src/Authentication/DefaultAuthenticationListener.php#L189-L191).\r\n\r\nThis issue started happening to me after I've updated apigility from 1.0.* to the latest."}}