OAuth.Password

The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged application. The authorization server should take special care when enabling this grant type and only allow it when other flows are not viable.

There's only one step in this process:

The client authenticates itself directly using the resource owner (user) credentials

After this step, the client owns a Token that can be used to authorize any subsequent request.

Authenticate

makeTokenRequest :

(Result Error AuthenticationSuccess -> msg)

-> Authentication

-> RequestParts msg

Builds the request components required to get a token in exchange of the resource owner (user) credentials

let req : Http.Request TokenResponse
    req = makeTokenRequest toMsg authentication |> Http.request

type alias Authentication =

{ credentials : Maybe Credentials

, url : Url

, scope : List String

, username : String

, password : String

}

Request configuration for a Password authentication

credentials (RECOMMENDED): Credentials needed for Basic authentication, if needed by the authorization server.
url (REQUIRED): The token endpoint to contact the authorization server.
scope (OPTIONAL): The scope of the access request.
password (REQUIRED): Resource owner's password
username (REQUIRED): Resource owner's username

type alias Credentials =

{ clientId : String

, secret : String

}

Describes at least a clientId and if defined, a complete set of credentials with the secret. Optional but may be required by the authorization server you interact with to perform a 'Basic' authentication on top of the authentication request.

  { clientId = "<my-client-id>"
  , secret = "<my-client-secret>"
  }

type alias AuthenticationSuccess =

{ token : Token

, refreshToken : Maybe Token

, expiresIn : Maybe Int

, scope : List String

}

The response obtained as a result of an authentication:

token (REQUIRED): The access token issued by the authorization server.
refreshToken (OPTIONAL): The refresh token, which can be used to obtain new access tokens using the same authorization grant as described in Section 6.
expiresIn (RECOMMENDED): The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value.
scope (OPTIONAL, if identical to the scope requested; otherwise, REQUIRED): The scope of the access token as described by Section 3.3.

type alias AuthenticationError =

{ error : ErrorCode

, errorDescription : Maybe String

, errorUri : Maybe String

}

Describes an OAuth error as a result of a request failure

error (REQUIRED): A single ASCII error code.
errorDescription (OPTIONAL) Human-readable ASCII text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the errorDescription parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
errorUri (OPTIONAL): A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the errorUri parameter MUST conform to the URI-reference syntax and thus MUST NOT include characters outside the set %x21 / %x23-5B / %x5D-7E.

type alias RequestParts a =

{ method : String

, headers : List Header

, url : String

, body : Body

, expect : Expect a

, timeout : Maybe Float

, tracker : Maybe String

}

Parts required to build a request. This record is given to Http.request in order to create a new request and may be adjusted at will.

JSON Decoders

defaultAuthenticationSuccessDecoder : Decoder AuthenticationSuccess

Json decoder for a positive response. You may provide a custom response decoder using other decoders from this module, or some of your own craft.

defaultAuthenticationSuccessDecoder : Decoder AuthenticationSuccess
defaultAuthenticationSuccessDecoder =
    D.map4 AuthenticationSuccess
        tokenDecoder
        refreshTokenDecoder
        expiresInDecoder
        scopeDecoder

defaultAuthenticationErrorDecoder : Decoder AuthenticationError

Json decoder for an errored response.

case res of
    Err (Http.BadStatus { body }) ->
        case Json.decodeString OAuth.Password.defaultAuthenticationErrorDecoder body of
            Ok { error, errorDescription } ->
                doSomething


            _ ->
                parserFailed


    _ ->
        someOtherError