java - How to generate token without client_secret in Spring Security OAuth2 -

this question has answer here:

• is possible access_token spring oauth2 server without client secret? 1 answer

i have spring security oauth 2.0 based application, configured jdbc , ldap. per oauth 2.0 specification, client secret must.

when generate token using following url generates token , works fine:

/oauth/token?grant_type=password&client_secret=test&client_id=test&username=test&password=test 

and when try generate token without client_secret gives:

401: unauthorized

error_description: "bad user credentials"

but want generate token without client_secret like:

/oauth/token?grant_type=password&username=test&password=test 

securityconfig.java:

 @configuration  @enablewebsecurity  @enableglobalmethodsecurity( prepostenabled = true )  public class applicationsecurityconfig extends websecurityconfigureradapter                               {      private static final int embedded_ldap_server_port = 33388;      @autowired     private userauthenticationprovider userauthenticationprovider;          @autowired     private ldapauthenticationprovider ldapauthenticationprovider;      @autowired     private authtokenstore oauthtokenstore;           @autowired     private authdelegatingauthenticationentrypoint  delegatingauthenticationentrypoint;      @override     @qualifier("authenticationmanagerbean")     @bean     protected authenticationmanager authenticationmanager() throws exception {         return new providermanager(arrays.aslist((authenticationprovider) ldapauthenticationprovider,userauthenticationprovider));     }     @override     protected void configure(httpsecurity http) throws exception {                http              .csrf().disable()              .sessionmanagement()                   .sessioncreationpolicy(sessioncreationpolicy.stateless)                   .and()              .authorizerequests()                   .anyrequest().authenticated()                   .and()              .exceptionhandling().authenticationentrypoint(delegatingauthenticationentrypoint);     }      @bean     public resourceservertokenservices tokenservice() {          defaulttokenservices tokenservices = new defaulttokenservices();         tokenservices.settokenstore(oauthtokenstore);         tokenservices.setreuserefreshtoken(true);         return tokenservices;     } 

unfortunately there no easy way around problem. spring security interprets standard strict:

this quote oauth2 spec, rfc 6749, section 4.3.2 (resource owner password credentials grant - access token request):

if client type confidential or client issued client
credentials (or assigned other authentication requirements), the
client must authenticate authorization server described
in section 3.2.1.

for spring security password grant falls category. section 3.2.1 requires client id , client password.

also spring security documentation goes way: 28.1.1 authorization server

unless want change authentication logic of spring security's oauth2 (not recommended) stuck.

from point of view there no problem. client id , password costs nothing , bring little bit more security application.