Client credentials grant
- Endpoints
The client credentials grant is intended for clients who are also resource owners that need to access their own data rather than acting on behalf of a user.
For example, an application that needs access to a protected resource to update its configuration might use the client credentials grant to get an access token.
The client credentials grant flow supports confidential clients only.
-
The client sends its credentials to the authorization server to authenticate and requests an access token.
-
If the client credentials are valid, the authorization server returns an access token to the client.
-
The client requests access to the protected resource from the resource server.
-
The resource server contacts the authorization server to validate the access token.
-
The authorization server validates the token and responds to the resource server.
-
If the token is valid, the resource server allows the client to access the protected resource.
Demonstrate the client credentials grant flow
Perform these steps to get an access token:
Prepare the demonstration
Complete these steps to prepare the client credentials grant flow demonstration:
-
AM is configured as an OAuth 2.0 authorization server. Ensure that:
-
The
Client Credentialsgrant type is configured in the Grant Types field.
For more information, refer to Authorization server configuration.
-
-
A confidential client called
myClientis registered in AM with the following configuration:-
Client secret:
forgerock -
Scopes:
write -
Grant Types:
Client Credentials
-
For more information, refer to Client application registration.
Get an access token using the client credentials grant
As the client, call /oauth2/access_token
specifying the client’s credentials and grant_type=client_credentials.
Confidential clients can authenticate to the OAuth 2.0 endpoints in several ways. This example uses the following form parameters:
-
client_id=your-client-id
-
client_secret=your-client-secret
For more information, refer to OAuth 2.0 client authentication.
If the OAuth 2.0 provider is configured for a subrealm rather than the Top Level Realm, you must specify it in the endpoint.
For example, if the OAuth 2.0 provider is configured for the /alpha realm,
use /oauth2/realms/root/realms/alpha/access_token.
For example:
$ curl \
--request POST \
--data "grant_type=client_credentials" \
--data "client_id=myClient" \
--data "client_secret=forgerock" \
--data "scope=write" \
"https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/access_token"|
The |
The authorization server returns an access token, for example:
{
"access_token": "<access-token>",
"scope": "write",
"token_type": "Bearer",
"expires_in": 3599
}