diff options
| author | Andrew Arnott <andrewarnott@gmail.com> | 2012-12-24 15:22:26 -0800 |
|---|---|---|
| committer | Andrew Arnott <andrewarnott@gmail.com> | 2012-12-24 15:22:26 -0800 |
| commit | edfa728182604ab7782a174ba3f6731f039df1b8 (patch) | |
| tree | ac75f725208bcc81ee709c658870023426fc458c /src/DotNetOpenAuth.OAuth2.AuthorizationServer | |
| parent | dd44e2f0be06168911d3e8aefbe2f10eb4c8fd99 (diff) | |
| download | DotNetOpenAuth-edfa728182604ab7782a174ba3f6731f039df1b8.zip DotNetOpenAuth-edfa728182604ab7782a174ba3f6731f039df1b8.tar.gz DotNetOpenAuth-edfa728182604ab7782a174ba3f6731f039df1b8.tar.bz2 | |
CreateAccessToken reveals username to host
IAuthorizationServerHost.CreateAccessToken now has access to authoring
usernames.
Fixes #219
Diffstat (limited to 'src/DotNetOpenAuth.OAuth2.AuthorizationServer')
| -rw-r--r-- | src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs index 3eac5a6..500b91d 100644 --- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs +++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs @@ -122,15 +122,15 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements { try { var authorizeResult = this.AuthorizationServer.CheckAuthorizeResourceOwnerCredentialGrant( - resourceOwnerPasswordCarrier.UserName, resourceOwnerPasswordCarrier.Password, resourceOwnerPasswordCarrier); + resourceOwnerPasswordCarrier.RequestingUserName, resourceOwnerPasswordCarrier.Password, resourceOwnerPasswordCarrier); if (authorizeResult.IsApproved) { resourceOwnerPasswordCarrier.CredentialsValidated = true; - resourceOwnerPasswordCarrier.UserName = authorizeResult.CanonicalUserName; + resourceOwnerPasswordCarrier.RequestingUserName = authorizeResult.CanonicalUserName; resourceOwnerPasswordCarrier.Scope.ResetContents(authorizeResult.ApprovedScope); } else { Logger.OAuth.ErrorFormat( "Resource owner password credential for user \"{0}\" rejected by authorization server host.", - resourceOwnerPasswordCarrier.UserName); + resourceOwnerPasswordCarrier.RequestingUserName); throw new TokenEndpointProtocolException(accessTokenRequest, Protocol.AccessTokenRequestErrorCodes.InvalidGrant, AuthServerStrings.InvalidResourceOwnerPasswordCredential); } } catch (NotSupportedException) { |