passport-oauth2-client-password

const express = require('express'); const passport = require('passport'); const ClientPasswordStrategy = require('passport-oauth2-client-password'); const app = express(); const port = 3000; // Middleware to parse request body (e.g., for client_id and client_secret) app.use(express.urlencoded({ extended: false })); app.use(express.json()); // Initialize Passport middleware app.use(passport.initialize()); // --- Mock Database (in a real app, this would be a database query) --- const clients = [ { id: 1, clientId: 'client123', clientSecret: 'secret123', name: 'Test Client' }, { id: 2, clientId: 'anotherClient', clientSecret: 'superSecret', name: 'Another Test Client' }, ]; // --- End Mock Database --- // Configure the Client Password strategy passport.use(new ClientPasswordStrategy( function(clientId, clientSecret, done) { console.log(`Attempting to authenticate client: ${clientId}`); const client = clients.find(c => c.clientId === clientId); if (!client) { console.log('Client not found.'); // `done(null, false)` indicates authentication failure. return done(null, false); } if (client.clientSecret !== clientSecret) { console.log('Client secret mismatch.'); return done(null, false); } console.log(`Client '${client.name}' authenticated successfully.`); // `done(null, client)` indicates success, attaching client to req.user return done(null, client); } )); // Define a token endpoint (or any endpoint requiring client authentication) app.post('/token', // Authenticate using the 'oauth2-client-password' strategy // `session: false` because clients typically don't establish sessions passport.authenticate('oauth2-client-password', { session: false }), (req, res) => { // If we reach here, the client is authenticated (req.user will contain the client object) console.log('Client authenticated successfully at /token endpoint.'); res.json({ message: 'Client authenticated successfully', client: req.user // The authenticated client object }); } ); // Simple root endpoint for demonstration app.get('/', (req, res) => { res.send('Welcome! Try POSTing to /token with client_id and client_secret in the body (form-urlencoded or JSON).'); }); app.listen(port, () => { console.log(`Server listening at http://localhost:${port}`); console.log('\n--- Test Commands ---'); console.log(`curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=client123&client_secret=secret123" http://localhost:${port}/token`); console.log(`curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=badclient&client_secret=badsecret" http://localhost:${port}/token`); console.log(`curl -X POST -H "Content-Type: application/json" -d '{"client_id":"client123","client_secret":"secret123"}' http://localhost:${port}/token`); });