Anonymous clients can now exchange resource owner credentials for refresh and access tokens.

(authenticated clients already could).

Fixes #100

1 files changed, 9 insertions, 5 deletions

diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
index 2a9a8a7..415c893 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
@@ -126,11 +126,13 @@ namespace DotNetOpenAuth.OAuth2 {
 			/// <param name="clientIdentifier">The identifier by which the authorization server should recognize this client.</param>
 			/// <param name="request">The outbound message to apply authentication information to.</param>
 			public override void ApplyClientCredential(string clientIdentifier, HttpWebRequest request) {
-				if (this.credential != null && this.credential.UserName == clientIdentifier) {
-					ErrorUtilities.VerifyHost(false, "Client identifiers \"{0}\" and \"{1}\" do not match.", this.credential.UserName, clientIdentifier);
-				}
+				if (clientIdentifier != null) {
+					if (this.credential != null && this.credential.UserName == clientIdentifier) {
+						ErrorUtilities.VerifyHost(false, "Client identifiers \"{0}\" and \"{1}\" do not match.", this.credential.UserName, clientIdentifier);
+					}
 
-				request.Credentials = this.credential ?? new NetworkCredential(clientIdentifier, this.clientSecret);
+					request.Credentials = this.credential ?? new NetworkCredential(clientIdentifier, this.clientSecret);
+				}
 			}
 		}
 
@@ -158,7 +160,9 @@ namespace DotNetOpenAuth.OAuth2 {
 			/// <param name="clientIdentifier">The identifier by which the authorization server should recognize this client.</param>
 			/// <param name="request">The outbound message to apply authentication information to.</param>
 			public override void ApplyClientCredential(string clientIdentifier, AuthenticatedClientRequestBase request) {
-				request.ClientSecret = this.secret;
+				if (clientIdentifier != null) {
+					request.ClientSecret = this.secret;
+				}
 			}
 		}
 	}