From 64d3967836ed2a648aae2edc2a11444b5497d8d6 Mon Sep 17 00:00:00 2001
From: Rui Yang <ruiya@vmware.com>
Date: Wed, 10 Nov 2021 14:43:22 -0500
Subject: [PATCH] add client crendential grant type

Signed-off-by: Rui Yang <ruiya@vmware.com>
---
 server/handlers.go | 25 +++++++++++++++++++++++++
 server/oauth2.go   |  1 +
 2 files changed, 26 insertions(+)

diff --git a/server/handlers.go b/server/handlers.go
index 5f8caf11af..1854c56546 100755
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -782,6 +782,8 @@ func (s *Server) handleToken(w http.ResponseWriter, r *http.Request) {
 		s.withClientFromStorage(w, r, s.handleRefreshToken)
 	case grantTypePassword:
 		s.withClientFromStorage(w, r, s.handlePasswordGrant)
+	case grantTypeClientCredentials:
+		s.withClientFromStorage(w, r, s.handleClientCredentialsGrant)
 	default:
 		s.tokenErrHelper(w, errUnsupportedGrantType, "", http.StatusBadRequest)
 	}
@@ -1032,6 +1034,29 @@ func (s *Server) handleUserInfo(w http.ResponseWriter, r *http.Request) {
 	w.Write(claims)
 }
 
+func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Request, client storage.Client) {
+	if err := r.ParseForm(); err != nil {
+		s.tokenErrHelper(w, errInvalidRequest, "Couldn't parse data", http.StatusBadRequest)
+		return
+	}
+	q := r.Form
+
+	nonce := q.Get("nonce")
+	scopes := strings.Fields(q.Get("scope"))
+
+	claims := storage.Claims{UserID: client.ID}
+
+	accessToken := storage.NewID()
+	idToken, expiry, err := s.newIDToken(client.ID, claims, scopes, nonce, accessToken, "", "client")
+	if err != nil {
+		s.tokenErrHelper(w, errServerError, fmt.Sprintf("failed to create ID token: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	resp := s.toAccessTokenResponse(idToken, accessToken, "", expiry)
+	s.writeAccessToken(w, resp)
+}
+
 func (s *Server) handlePasswordGrant(w http.ResponseWriter, r *http.Request, client storage.Client) {
 	// Parse the fields
 	if err := r.ParseForm(); err != nil {
diff --git a/server/oauth2.go b/server/oauth2.go
index 998bf02ae5..24adbf67c5 100644
--- a/server/oauth2.go
+++ b/server/oauth2.go
@@ -131,6 +131,7 @@ const (
 	grantTypeImplicit          = "implicit"
 	grantTypePassword          = "password"
 	grantTypeDeviceCode        = "urn:ietf:params:oauth:grant-type:device_code"
+	grantTypeClientCredentials = "client_credentials"
 )
 
 const (