From 65c1a7bd12f552e9b8daa49eb04d8e9275ee5aac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Tue, 29 Sep 2026 12:04:05 +0200 Subject: [PATCH] feat: enable client credentials grant for machine-to-machine api clients The Teamer app imports travel and hotel master data nightly with no user in the loop. AuthorizationCodeListener is bound to AUTHORIZATION_REQUEST_RESOLVE, which only the auth code grant dispatches, so a userless token never reaches the required_roles gate. Drops the tagged grant service added in 79709e3a. That tag registered client_credentials through the bundle's @deprecated grant configurator, which runs regardless of enable_client_credentials_grant and re-enabled the grant a second time with its own PT1H. Two enableGrantType() calls for one grant left the lifetime decided by call order. M2M tokens now use the shared access_token_ttl of PT10M. Co-Authored-By: Claude Opus 5 --- config/packages/league_oauth2_server.yaml | 2 +- config/services.yaml | 5 ----- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/config/packages/league_oauth2_server.yaml b/config/packages/league_oauth2_server.yaml index 334f033c..26a2cba6 100644 --- a/config/packages/league_oauth2_server.yaml +++ b/config/packages/league_oauth2_server.yaml @@ -4,7 +4,7 @@ league_oauth2_server: private_key_passphrase: null encryption_key: '%env(resolve:OAUTH_ENCRYPTION_KEY)%' require_code_challenge_for_public_clients: true - enable_client_credentials_grant: false + enable_client_credentials_grant: true enable_auth_code_grant: true enable_refresh_token_grant: true enable_password_grant: false diff --git a/config/services.yaml b/config/services.yaml index ad5eaca6..4d9c21fb 100644 --- a/config/services.yaml +++ b/config/services.yaml @@ -386,8 +386,3 @@ services: whitelisted_ips: '%env(csv:MAINTENANCE_MODE_IP_WHITELIST)%' whitelisted_routes: '%env(csv:MAINTENANCE_MODE_ROUTE_WHITELIST)%' whitelisted_paths: '%env(csv:MAINTENANCE_MODE_PATH_WHITELIST)%' - - league.oauth2_server.grant.client_credentials: - class: League\OAuth2\Server\Grant\ClientCredentialsGrant - tags: - - { name: league.oauth2_server.authorization_server.grant, accessTokenTTL: 'PT1H' }