Method Token

internal/controller/oidc_controller.go:198–372

(c *gin.Context)

}

func (controller *OIDCController) Token(c *gin.Context) {
	if !controller.oidc.IsConfigured() {
		tlog.App.Warn().Msg("OIDC not configured")
		c.JSON(404, gin.H{
			"error": "not_found",
		})
		return
	}

	var req TokenRequest

	err := c.Bind(&req)
	if err != nil {
		tlog.App.Error().Err(err).Msg("Failed to bind token request")
		c.JSON(400, gin.H{
			"error": "invalid_request",
		})
		return
	}

	err = controller.oidc.ValidateGrantType(req.GrantType)
	if err != nil {
		tlog.App.Warn().Str("grant_type", req.GrantType).Msg("Unsupported grant type")
		c.JSON(400, gin.H{
			"error": err.Error(),
		})
		return
	}

	// First we try form values
	creds := ClientCredentials{
		ClientID:     req.ClientID,
		ClientSecret: req.ClientSecret,
	}

	// If it fails, we try basic auth
	if creds.ClientID == "" || creds.ClientSecret == "" {
		tlog.App.Debug().Msg("Tried form values and they are empty, trying basic auth")

		clientId, clientSecret, ok := c.Request.BasicAuth()

		if !ok {
			tlog.App.Error().Msg("Missing authorization header")
			c.Header("www-authenticate", `Basic realm="Tinyauth OIDC Token Endpoint"`)
			c.JSON(400, gin.H{
				"error": "invalid_client",
			})
			return
		}

		creds.ClientID = clientId
		creds.ClientSecret = clientSecret
	}

	// END - we don't support other authentication methods

	client, ok := controller.oidc.GetClient(creds.ClientID)