OAuth2 client credentials

Use OAuth2 client credentials middleware to secure HTTP endpoints

The OAuth2 client credentials HTTP middleware enables the OAuth2 Client Credentials flow on a Web API without modifying the application. This design separates authentication/authorization concerns from the application, so that application operators can adopt and configure authentication/authorization providers without impacting the application code.

Component format

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: oauth2clientcredentials
  5. spec:
  6.   type: middleware.http.oauth2clientcredentials
  7.   version: v1
  8.   metadata:
  9.   - name: clientId
  10.     value: "<your client ID>"
  11.   - name: clientSecret
  12.     value: "<your client secret>"
  13.   - name: scopes
  14.     value: "https://www.googleapis.com/auth/userinfo.email"
  15.   - name: tokenURL
  16.     value: "https://accounts.google.com/o/oauth2/token"
  17.   - name: headerName
  18.     value: "authorization"

Warning

The above example uses secrets as plain strings. It is recommended to use a secret store for the secrets as described here.

Spec metadata fields

FieldDetailsExample
clientIdThe client ID of your application that is created as part of a credential hosted by a OAuth-enabled platform
clientSecretThe client secret of your application that is created as part of a credential hosted by a OAuth-enabled platform
scopesA list of space-delimited, case-sensitive strings of scopes which are typically used for authorization in the application“https://www.googleapis.com/auth/userinfo.email“
tokenURLThe endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token“https://accounts.google.com/o/oauth2/token“
headerNameThe authorization header name to forward to your application“authorization”
endpointParamsQuerySpecifies additional parameters for requests to the token endpointtrue
authStyleOptionally specifies how the endpoint wants the client ID & client secret sent. See the table of possible values below0

Possible values for authStyle

ValueMeaning
1Sends the “client_id” and “client_secret” in the POST body as application/x-www-form-urlencoded parameters.
2Sends the “client_id” and “client_secret” using HTTP Basic Authorization. This is an optional style described in the OAuth2 RFC 6749 section 2.3.1.
0Means to auto-detect which authentication style the provider wants by trying both ways and caching the successful way for the future.

Dapr configuration

To be applied, the middleware must be referenced in a configuration. See middleware pipelines.

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Configuration
  3. metadata:
  4.   name: appconfig
  5. spec:
  6.   httpPipeline:
  7.     handlers:
  8.     - name: oauth2clientcredentials
  9.       type: middleware.http.oauth2clientcredentials

Last modified June 19, 2023: Merge pull request #3565 from dapr/aacrawfi/skip-secrets-close (b1763bf)