Question

i started using oauth2 gem by intridea (http://github.com/intridea/oauth2) and don’t know how to fix this problem. I have developed both client and server and on request for access_token i see no grant_type parameter. My code from client callback controller

class CallbackController < Devise::OauthCallbacksController
  def accounts
    access_token = accounts_config.access_token_by_code(params[:code])
    @user = User.find_for_accounts_oauth(access_token,
signed_in_resource)

    if @user.persisted? && @user.errors.empty?
      sign_in @user
      set_oauth_flash_message :notice, :success
      redirect_to after_oauth_success_path_for(@user) #=> redirects to
user_root_path or root_path
    else
      session[:user_accounts_oauth_token] = access_token.token
      render_for_auth #=> renders sign up view by default
    end

  end
end 

and from User model

class User < ActiveRecord::Base
  devise :database_authenticatable, :oauthable

  def self.find_for_accounts_oauth(access_token,
signed_in_resource=nil)

    data =
ActiveSupport::JSON.decode(access_token.get(Settings.oauth.site +
Settings.oauth.access_token_path))

    if user = User.find_by_username(data["username"])
      user
    else
      # Create an user with a stub password.
      User.create!(:username => data["username"], :password =>
Devise.friendly_token)
    end

  end
end 

Logs from provider

Started POST "/oauth/token" for 127.0.0.1 at 2010-09-17 00:17:44 +0400
  Processing by Oauth::TokenController#get_token as */*
  Parameters:
{"client_id"=>"9ddf5f526127a8858485f2c9401c7152cfaf870da62267e6f54643de53eb6a76",
"client_secret"=>"84388e2ca839c2834177024a6f358b1415bcd3ea936be1148443d9df2f7cf363",
"redirect_uri"=>"http://test.local.lo/users/oauth/accounts/callback",
"type"=>"web_server",
"code"=>"d264c2496d0dc5c494b7269f2f9e4c30cd55a571b6944d3231f63577acd12b1b"}
  SQL (0.8ms)   SELECT a.attname, format_type(a.atttypid,
a.atttypmod), d.adsrc, a.attnotnull
 FROM pg_attribute a LEFT JOIN pg_attrdef d
 ON a.attrelid = d.adrelid AND a.attnum = d.adnum
 WHERE a.attrelid = '"oauth_clients"'::regclass
 AND a.attnum > 0 AND NOT a.attisdropped
 ORDER BY a.attnum
Oauth error: invalid grant_type
Rendered text template (0.0ms)
Completed 400 Bad Request in 112ms (Views: 37.9ms | ActiveRecord:
178.2ms) 

and from client

Started GET "/users/oauth/accounts/callback?
code=d264c2496d0dc5c494b7269f2f9e4c30cd55a571b6944d3231f63577acd12b1b&&expires_in=3599"
for 127.0.0.1 at 2010-09-17 00:17:44 +0400
  Processing by Devise::OauthCallbacksController#accounts as HTML
  Parameters:
{"code"=>"d264c2496d0dc5c494b7269f2f9e4c30cd55a571b6944d3231f63577acd12b1b",
"expires_in"=>"3599"}
Completed   in 343ms

OAuth2::HTTPError (Received HTTP 400 during request.):

Rendered /opt/local/lib/ruby1.9/gems/1.9.1/gems/actionpack-3.0.0/lib/
action_dispatch/middleware/templates/rescues/_trace.erb (1.4ms)
Rendered /opt/local/lib/ruby1.9/gems/1.9.1/gems/actionpack-3.0.0/lib/
action_dispatch/middleware/templates/rescues/_request_and_response.erb
(30.0ms)
Rendered /opt/local/lib/ruby1.9/gems/1.9.1/gems/actionpack-3.0.0/lib/
action_dispatch/middleware/templates/rescues/diagnostics.erb within
rescues/layout (36.7ms) 

Any idea how to fix it?

Answer 1

The OAuth 2.0 specification has moved on since the oauth2 gem was last updated.

Draft 10, and possibly earlier, use a grant_type parameter instead of type, and the values have changed too: authorization_code replaces web_server.

The OAuth 2.0 spec explains more:

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-10

To resolve this issue, the gem needs to be updated to be compatible with a later version of the spec.