From 454d21ab5ad87def97e712bc53e8e8ef50a5c678 Mon Sep 17 00:00:00 2001 From: Emelia Smith Date: Tue, 1 Oct 2024 11:56:58 +0200 Subject: [PATCH] Remove OAuth Password Grant Type support (#30960) --- config/initializers/doorkeeper.rb | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb index b47e76c08b..de1c75f576 100644 --- a/config/initializers/doorkeeper.rb +++ b/config/initializers/doorkeeper.rb @@ -9,16 +9,9 @@ Doorkeeper.configure do current_user || redirect_to(new_user_session_url) end - resource_owner_from_credentials do |_routes| - user = User.authenticate_with_ldap(email: request.params[:username], password: request.params[:password]) if Devise.ldap_authentication - user ||= User.authenticate_with_pam(email: request.params[:username], password: request.params[:password]) if Devise.pam_authentication - - if user.nil? - user = User.find_by(email: request.params[:username]) - user = nil unless user&.valid_password?(request.params[:password]) - end - - user unless user&.otp_required_for_login? + # Disable Resource Owner Password Credentials Grant Flow + resource_owner_from_credentials do + nil end # Doorkeeper provides some administrative interfaces for managing OAuth @@ -169,7 +162,7 @@ Doorkeeper.configure do # http://tools.ietf.org/html/rfc6819#section-4.4.3 # - grant_flows %w(authorization_code password client_credentials) + grant_flows %w(authorization_code client_credentials) # Under some circumstances you might want to have applications auto-approved, # so that the user skips the authorization step.