Lack of OAuth2 device flow client authentication handling

[ReLive27]

Current Behavior
OAuth2ClientAuthenticationFilter handles OAuth 2.0 client authentication requests. However, the corresponding AuthenticationConverter implementation class and AuthenticationProvider implementation class are not provided for the OAuth2 device flow.

Expected behavior
This requires us to customize the corresponding AuthenticationConverter implementation class and AuthenticationProvider implementation class, but I think this should be a function of Spring Authorization Server

[jgrandja]

@ReLive27

This requires us to customize the corresponding AuthenticationConverter implementation class and AuthenticationProvider implementation class, but I think this should be a function of Spring Authorization Server

Yes, this is correct. The consuming application is responsible for customizing client authentication to allow for public client ("unauthenticated") access.

Spring Authorization Server cannot provide this capability out-of-the-box as it would not adhere to the secure by default principle, since the token endpoint would be "open" allowing a client to obtain an access token simply by providing the client_id parameter only.

For further context, see this comment.

See gh-1157 and related commit as it shows how to customize public client authentication.