Authenticate with OAuth2 client_credentials in Symfony2
<p>I want to do server-to-server authentication for my API using OAuth2 and Symfony2 (Symfony3 actually). I am using <code>FOSOAuthServerBundle</code>.</p>

<p>The remote server will not be making requests on behalf of any user, so I believe <code>client_credentials</code> is the proper grant type to use.</p>

<p>I have created a client and am able to obtain an access token. However, I am having an issue with protecting an endpoint with a <code>client_credentials</code> token. This is what is in my security.yml</p>

<pre><code>firewalls:
    api:
        pattern:    ^/api/v1
        fos_oauth:  true
        stateless:  true
        anonymous:  false # can be omitted as its default value

access_control:
    - { path: ^/api/v1, roles: [ IS_AUTHENTICATED_FULLY ] }
</code></pre>

<p>When I try to access something in <code>/api/v1</code> using the Bearer Authorization header, I get an error</p>

<pre><code>Full authentication is required to access this resource
</code></pre>

<p>Here is a sample request:</p>

<pre><code>GET /app_dev.php/api/v1/user HTTP/1.1
Host: local.dev
Authorization: Bearer NDFhMzViZjQ2YjMyYjFlNzBjZTZiMTU2ZjdhY2I4ZmZhZjY2MmVkMjU3NzNjNDE2NGI2YzEzMWFjZGQ5MzE4NA
</code></pre>

<p>I assume the problem is that since I am using client_credentials there is no user and thus IS_FULLY_AUTHENTICATED is not true. If that is the case, how can I authenticate the client without a user?</p>

<p><strong>Note:</strong> I have also tried removing the lines</p>

<pre><code>access_control:
    - { path: ^/api/v1, roles: [ IS_AUTHENTICATED_FULLY ] }
</code></pre>

<p>then trying to access the client details in the controller with the following:</p>

<pre><code>$tokenManager = $this-&gt;get('fos_oauth_server.access_token_manager.default');
$accessToken = $tokenManager-&gt;findTokenByToken(
    $this-&gt;get('security.token_storage')-&gt;getToken()-&gt;getToken()
);
$client = $accessToken-&gt;getClient();
</code></pre>

<p>but then I get the error:</p>

<pre><code>Attempted to call an undefined method named "getToken" of class "Symfony\Component\Security\Core\Authentication\Token\AnonymousToken"
</code></pre>