Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upChange validate_user/validate_grant_type order for Resource Owner Password Grant #643
Labels
Milestone
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The flows shown in the dot graph (see #642 (comment)) uncovered an issue in the order of the calls.
Resource Owner Password Grant
validate_grant_typeis called AFTERvalidate_user, which can lead to unexpected behavior depending of thevalidate_userimplementation (e.g. create a session on the idP side but should be forbidden). For the other flows,validate_grant_typeis correctly called BEFORE.Since it changes the request validator calling order, it is considered as a breaking change.