{"action":"created","issue":{"url":"https://api.github.com/repos/p2/OAuth2/issues/47","labels_url":"https://api.github.com/repos/p2/OAuth2/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/p2/OAuth2/issues/47/comments","events_url":"https://api.github.com/repos/p2/OAuth2/issues/47/events","html_url":"https://github.com/p2/OAuth2/issues/47","id":106433745,"number":47,"title":"OAuth2PasswordGrant should use token url and parse refresh token","user":{"login":"damienrambout","id":1846768,"avatar_url":"https://avatars.githubusercontent.com/u/1846768?v=3","gravatar_id":"","url":"https://api.github.com/users/damienrambout","html_url":"https://github.com/damienrambout","followers_url":"https://api.github.com/users/damienrambout/followers","following_url":"https://api.github.com/users/damienrambout/following{/other_user}","gists_url":"https://api.github.com/users/damienrambout/gists{/gist_id}","starred_url":"https://api.github.com/users/damienrambout/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/damienrambout/subscriptions","organizations_url":"https://api.github.com/users/damienrambout/orgs","repos_url":"https://api.github.com/users/damienrambout/repos","events_url":"https://api.github.com/users/damienrambout/events{/privacy}","received_events_url":"https://api.github.com/users/damienrambout/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-14T21:40:17Z","updated_at":"2015-09-15T05:47:26Z","closed_at":null,"body":"Hi,\r\n\r\nI'm using `OAuth2PasswordGrant` in my project and I don't think the \"password\" flow is fully implemented.\r\n\r\nFirst, `OAuth2PasswordGrant` will try to use the `authorization_uri` instead of the `token_uri` to request and `access_token` using the `username` and `password`. (This can be hacked by using the a token uri as the `authorization_uri` value).\r\n\r\nSecond, I believe all grant types allow to refresh `access_token` using the `refresh_token`. I just see this implemented in `OAuth2CodeGrant`. I think all the refresh logic (`refreshToken`, `doRefreshToken()`, ...) should be shared with `OAuth2PasswordGrant`.\r\n\r\nCheers."},"comment":{"url":"https://api.github.com/repos/p2/OAuth2/issues/comments/140287941","html_url":"https://github.com/p2/OAuth2/issues/47#issuecomment-140287941","issue_url":"https://api.github.com/repos/p2/OAuth2/issues/47","id":140287941,"user":{"login":"p2","id":358485,"avatar_url":"https://avatars.githubusercontent.com/u/358485?v=3","gravatar_id":"","url":"https://api.github.com/users/p2","html_url":"https://github.com/p2","followers_url":"https://api.github.com/users/p2/followers","following_url":"https://api.github.com/users/p2/following{/other_user}","gists_url":"https://api.github.com/users/p2/gists{/gist_id}","starred_url":"https://api.github.com/users/p2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/p2/subscriptions","organizations_url":"https://api.github.com/users/p2/orgs","repos_url":"https://api.github.com/users/p2/repos","events_url":"https://api.github.com/users/p2/events{/privacy}","received_events_url":"https://api.github.com/users/p2/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T05:47:26Z","updated_at":"2015-09-15T05:47:26Z","body":"Yes, you're correct with both observations. Thanks!\n\n\n> On 14 Sep 2015, at 23:40, Damien Rambout <notifications@github.com> wrote:\n> \n> Hi,\n> \n> I'm using OAuth2PasswordGrant in my project and I don't think the \"password\" flow is fully implemented.\n> \n> First, OAuth2PasswordGrant will try to use the authorization_uri instead of the token_uri to request and access_token using the username and password. (This can be hacked by using the a token uri as the authorization_uri value).\n> \n> Second, I believe all grant types allow to refresh access_token using the refresh_token. I just see this implemented in OAuth2CodeGrant. I think all the refresh logic (refreshToken, doRefreshToken(), ...) should be shared with OAuth2PasswordGrant.\n> \n> Cheers.\n> \n> —\n> Reply to this email directly or view it on GitHub.\n> \n"}}