Authorization server Client Credentials Grant linked with existing user

Support
#1

Hi,

I’m using Jmix 2.1.2 and this products:

IntelliJ IDEA 2023.3.2 (Community Edition)
Build #IC-233.13135.103, built on December 20, 2023
Runtime version: 17.0.9+7-b1087.9 amd64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.
Windows 10.0
GC: G1 Young Generation, G1 Old Generation
Memory: 2048M
Cores: 16
Non-Bundled Plugins:
de.docs_as_co.intellij.plugin.diagramsnet (0.2.4)
PlantUML integration (7.4.2-IJ2023.2)
io.jmix.studio (2.1.2-233)
Kotlin: 233.13135.103-IJ

I’ve seen in Authorization server Client Credentials Grant should not be linked with existing user · Issue #1768 · jmix-framework/jmix · GitHub that, since 2.0 version, there isn’t the link between a client and an user.

I’m interested in “Client Credentials Grant” and this link would very useful because using the properties file is a too much static option in my case (my application is going to have tens of different clients because is going to give service to many different organizations). Is there any way of setting this link in my application?

I’ve tried RegisteredClientRepository ( Access Control :: Jmix Documentation ) with a client called “admin” as the main user, and the token is created correctly:

curl -X POST http://localhost:8080/oauth2/token \
   --basic --user admin:admin \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d "grant_type=client_credentials"

But when I try to recover the list of users, as in the most simple example:

curl -X GET http://localhost:8080/rest/entities/User \
    -H "Authorization: Bearer <access_token>"

The security system reports that admin can’t read User.

I’d appreciate any kind of help.

Thanks in advance.

Pablo

#2

Problem solved thanks to a filter and systemAuthenticator.withUser.