{"action":"created","issue":{"url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/2","labels_url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/2/comments","events_url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/2/events","html_url":"https://github.com/mariubog/oauth-client-sample/issues/2","id":96694178,"number":2,"title":"difference between ClientOnlyResourceOwnerPasswordResourceDetails and ResourceOwnerPasswordResourceDetails?","user":{"login":"sridhar1982","id":4313954,"avatar_url":"https://avatars.githubusercontent.com/u/4313954?v=3","gravatar_id":"","url":"https://api.github.com/users/sridhar1982","html_url":"https://github.com/sridhar1982","followers_url":"https://api.github.com/users/sridhar1982/followers","following_url":"https://api.github.com/users/sridhar1982/following{/other_user}","gists_url":"https://api.github.com/users/sridhar1982/gists{/gist_id}","starred_url":"https://api.github.com/users/sridhar1982/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sridhar1982/subscriptions","organizations_url":"https://api.github.com/users/sridhar1982/orgs","repos_url":"https://api.github.com/users/sridhar1982/repos","events_url":"https://api.github.com/users/sridhar1982/events{/privacy}","received_events_url":"https://api.github.com/users/sridhar1982/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-23T00:00:31Z","updated_at":"2015-07-23T03:10:08Z","closed_at":null,"body":"@mariubog A very good material for spinning up services that talk to Authorization server.  :+1:\r\n\r\nI have a few questions as I browsed through your code?\r\n\r\n1. what is the difference between `ClientOnlyResourceOwnerPasswordResourceDetails` and  `ResourceOwnerPasswordResourceDetails` that you have used in `OauthClientConfig.java`? \r\nwhen should I use one over the other?\r\n\r\n2. Similarly in `MyRestController.java`, you have used `oauthConnectionService.getClientOnlyResults` and `oauthConnectionService.getResults`? what is the difference here and when to prefer one over the other?\r\n\r\n3.  In the `OauthClientConfig.java`, you have hard-coded the values for username and password. If I want to this use this client to accept username and password (either as HTTP basic header) or request param and set them on resource (below code) before making OAuth request, how can this be done?\r\n\r\nsomething like this\r\n`http://localhost:8005/results-asynch?username=roy&password=spring`.\r\nMay be this is not secure. what is the recommended way here?\r\n\r\n```java\r\n@Bean\r\n\t@Qualifier(\"myFullAcessDetails\")\r\n\tprotected OAuth2ProtectedResourceDetails fullAccessresourceDetails(\r\n\t\t\tString tokenUrl) {\r\n\t\tResourceOwnerPasswordResourceDetails resource = new ResourceOwnerPasswordResourceDetails();\r\n\t\tresource.setAccessTokenUri(tokenUrl);\r\n\t\tresource.setClientId(\"clientapp\");\r\n\t\tresource.setClientSecret(\"123456\");\r\n\t\tresource.setGrantType(\"password\");\r\n\t\tresource.setScope(DemoApplicationUtils.getScopesList(\"read\", \"write\"));\r\n\t\tresource.setUsername(\"roy\");\r\n\t\tresource.setPassword(\"spring\");\r\n\t\treturn resource;\r\n\t}\r\n```\r\n\r\n\r\nI am interested to see how I can use this sample as a controller that authenticates with authServer for a given user and the controller subsequently makes micro-services calls. \r\n this [post](https://stackoverflow.com/questions/31525237/how-to-get-scope-associated-with-access-token-in-spring-oauth-while-building-mic) for more info.\r\n\r\nLooking forward to more samples from you (may be microservices that authenticates with AuthServer ??). Thanks for the contributing these.\r\n\r\nThanks\r\n"},"comment":{"url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/comments/123947503","html_url":"https://github.com/mariubog/oauth-client-sample/issues/2#issuecomment-123947503","issue_url":"https://api.github.com/repos/mariubog/oauth-client-sample/issues/2","id":123947503,"user":{"login":"mariubog","id":10479867,"avatar_url":"https://avatars.githubusercontent.com/u/10479867?v=3","gravatar_id":"","url":"https://api.github.com/users/mariubog","html_url":"https://github.com/mariubog","followers_url":"https://api.github.com/users/mariubog/followers","following_url":"https://api.github.com/users/mariubog/following{/other_user}","gists_url":"https://api.github.com/users/mariubog/gists{/gist_id}","starred_url":"https://api.github.com/users/mariubog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mariubog/subscriptions","organizations_url":"https://api.github.com/users/mariubog/orgs","repos_url":"https://api.github.com/users/mariubog/repos","events_url":"https://api.github.com/users/mariubog/events{/privacy}","received_events_url":"https://api.github.com/users/mariubog/received_events","type":"User","site_admin":false},"created_at":"2015-07-23T03:10:08Z","updated_at":"2015-07-23T03:10:08Z","body":"ad 1\r\nThis example is little misleading if you look at it and I am sorry about that.\r\nBasically because Roy does not provide access to the resource that would be accessible only by the client without user authentication. I ll try to ask Roy to update and send him pull request.\r\nHere is what I mean, I just wanted to show how to write template that will work with client only authentication from the point of view of the creator of template. \r\nIf you look at the code you will see that I override in `ClientOnlyResourceOwnerPasswordResourceDetails` `isClientOnly` to return `true` instead of default `false` for `BaseOAuth2ProtectedResourceDetails` it is false because it requires identification of the User by default, by making 'clientOnly' return true it only requires identification of the Client without previous authentication of the User. \r\nIt shows how to do it if there is resource on the Oauth server that allows access only with client authentication without (default for the template) user authentication.\r\nBut since there is no such a resource my `OAuth2ProtectedResourceDetails` implementation for this approach still provides username and password of the user besides the client credentials. Its a cheat and I ll try to fix it when I have little time.  Oauth server distinguishes between client and user and they are both completely different entities.\r\n\r\nad 2 Part of the response to this one is already in point 1, when to use them? basically client only is used when you access resource that is not reserved for any particular user  or before user is authenticated you just provide clientid and secret and you will receive token for your purpose. \r\n\r\nad 3 Yes it is hard coded just to show you basics, in real life most of this stuff would be either provided by the user or read from some external store. I just made it simple and tried to make it visible how to create Oauth template, because few people have been having problems with it. If you want to provide your own credentials of course some of this stuff can not be created as hard coded beans but `OAuth2RestOperations` does allow you to access predefined resourceDetails `getDetails()` and then maybe cast it into `ResourceOwnerPasswordResourceDetails ` and provide your own credentials. It is really up to you how you design it.\r\n\r\nQuote:\r\n\"something like this\r\nhttp://localhost:8005/results-asynch?username=roy&password=spring.\"\r\n\r\n`result-asynch` does not seem to work for me at the moment maybe is is due to updating and changes in new version, I do not know. I ll look at it when I have little time next couple of days.\r\nBesides whole login process is having problem in this little example. I ll look at it in next couple of days.\r\n\r\nSorry for inconvenience.\r\n \r\n\r\n\r\n\r\n"}}