User authentication fails if user name or password contains character colon ":"

[patrikni]

Summary

DefaultClientAuthenticationHandler.authenticateTokenRequest() does not work properly if user name or password contain special characters. For example ":". Based on my specification search the user name and password has to be url encoded.

Actual Behavior

The user with user name containing colon cannot login. The provider returns exception.

Expected Behavior

The user with user name containing colon can be authenticated.

Configuration

Local openid provider.

Version

At least 2.2.x and 2.3.x.

Sample

Test case user credentials:
String userName="my:super:user";
String password ="secret:pwd";

The bug in the source code location:
// line in 32 of org.springframework.security.oauth2.client.token.auth.DefaultClientAuthenticationHandler.authenticateTokenRequest()
case header:
form.remove("client_secret");
headers.add("Authorization",
// original code which does work!
String.format("Basic %s", new String(
Base64.encode(
String.format("%s:%s", resource.getClientId(),
// my fix which works! clientSecret).getBytes("UTF-8")), "UTF-8")));
String.format("Basic %s", new String(
Base64.encode(
String.format("%s:%s", URLEncoder.encode(resource.getClientId()),
URLEncoder.encode(clientSecret)).getBytes("UTF-8")), "UTF-8")));
break;

[OrangeDog]

This is a specific case of #1826.
Any colons in the credentials should be encoded by the client and decided by the server.

[jgrandja]

@patrikni

Upon reviewing RFC-7617, it states:

The user-id and password MUST NOT contain any control characters (see
"CTL" in Appendix B.1 of [RFC5234]).

Furthermore, a user-id containing a colon character is invalid, as
the first colon in a user-pass string separates user-id and password
from one another; text after the first colon is part of the password.
User-ids containing colons cannot be encoded in user-pass strings.

I'm going to close this since a user-id containing a colon character is invalid.

[OrangeDog]

user-id containing a colon character is invalid

While that is true it does not apply in this case. RFC-6749 describes the process of converting a client identifier (which may contain a colon) into a valid Basic auth user-id.

[jasperkamerling]

For anybody that encounters this issue. You can work around this by changing the client-authentication-method property of your registration to post.
This sends the client id in a post body instead of basic64 encoded basic authentication header. This means special characters can be used.