ClientCredentialsGrant

Definition

Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.Object

Syntax

Microsoft.OData.Mcp.Authentication.Outbound.ClientCredentialsGrant

Summary

Runs the RFC 6749 section 4.4 client credentials grant: a confidential client presents its own identifier and secret and receives an access token, with no end user and no elicitation anywhere in the path.

Remarks

Per specs/v3/AUTHENTICATION.md “Grants → Client credentials” the client authentication method is client_secret_post whenever the authorization server advertises it — or advertises nothing at all, which RFC 6749 leaves open — and client_secret_basic otherwise; v1 is secret-only, with no client certificate. Per AUTH-12 the secret is never logged: it travels only in the form or the Basic header TokenEndpointClient builds, and the Information line here carries only the redacted token shape. A client credentials response carries no refresh token — there is no end user session to refresh — so a caller whose access token has expired re-runs this grant rather than looking for one.

Examples

var response = await grant.AcquireAsync(metadata, "daemon", clientSecret, "read", resource, cancellationToken);
var token = response.ToTokenContainer(
    previousRefreshToken: null,
    clientId: "daemon",
    clientSecret: clientSecret,
    authorizationServer: metadata.Issuer!,
    tokenEndpointAuthMethod: ClientCredentialsGrant.ResolveAuthMethod(metadata));

Constructors

.ctor

Initializes a new instance of the ClientCredentialsGrant class.

Syntax

public ClientCredentialsGrant(Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient tokenEndpointClient, Microsoft.Extensions.Logging.ILogger<Microsoft.OData.Mcp.Authentication.Outbound.ClientCredentialsGrant> logger)

Parameters

Name	Type	Description
`tokenEndpointClient`	`Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient`	The client the token POST goes through.
`logger`	`Microsoft.Extensions.Logging.ILogger<Microsoft.OData.Mcp.Authentication.Outbound.ClientCredentialsGrant>`	The logger this instance records the redacted shape of each issued token to.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when tokenEndpointClient or logger is `null`.

.ctor Inherited

Inherited from object

Syntax

public Object()

Methods

AcquireAsync

Obtains an access token for the client itself.

Syntax

public System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointResponse> AcquireAsync(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata, string clientId, string clientSecret, string scope, System.Uri resource, System.Threading.CancellationToken cancellationToken)

Parameters

Name	Type	Description
`metadata`	`Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata`	The authorization server metadata whose `token_endpoint` is posted to.
`clientId`	`string`	The confidential client identifier.
`clientSecret`	`string`	The client secret; never logged.
`scope`	`string?`	The space-delimited scope to request, or `null` to request none.
`resource`	`System.Uri?`	The RFC 8707 resource indicator, sent exactly as it was published or configured, or `null` when the request sends none.
`cancellationToken`	`System.Threading.CancellationToken`	The token that cancels the request.

Returns

Type: System.Threading.Tasks.Task<Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointResponse> The successful token response, which normally carries no refresh token.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when metadata is `null`.
`ArgumentException`	Thrown when clientId or clientSecret is `null`, empty, or whitespace.
`InvalidOperationException`	Thrown when metadata carries no token endpoint.
`OAuthTokenException`	Thrown when the authorization server rejects the credentials — `invalid_client` — or when the
request fails at the transport.

Examples

try
{
    var response = await grant.AcquireAsync(metadata, clientId, clientSecret, scope, resource, cancellationToken);
}
catch (OAuthTokenException ex) when (ex.Error == "invalid_client")
{
    // ODATA_MCP_CLIENT_SECRET is wrong or the client is not registered.
}

Equals Inherited Virtual

Inherited from object

Syntax

public virtual bool Equals(object obj)

Parameters

Name	Type	Description
`obj`	`object?`	-

Returns

Type: bool

Equals Inherited

Inherited from object

Syntax

public static bool Equals(object objA, object objB)

Parameters

Name	Type	Description
`objA`	`object?`	-
`objB`	`object?`	-

Returns

Type: bool

GetHashCode Inherited Virtual

Inherited from object

Syntax

public virtual int GetHashCode()

Returns

Type: int

GetType Inherited

Inherited from object

Syntax

public System.Type GetType()

Returns

Type: System.Type

MemberwiseClone Inherited

Inherited from object

Syntax

protected internal object MemberwiseClone()

Returns

Type: object

ReferenceEquals Inherited

Inherited from object

Syntax

public static bool ReferenceEquals(object objA, object objB)

Parameters

Name	Type	Description
`objA`	`object?`	-
`objB`	`object?`	-

Returns

Type: bool

ResolveAuthMethod

Selects the token endpoint authentication method this grant uses against an authorization server.

Syntax

public static string ResolveAuthMethod(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata)

Parameters

Name	Type	Description
`metadata`	`Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata`	The authorization server metadata whose `token_endpoint_auth_methods_supported` is consulted.

Returns

Type: string TokenEndpointClient.AuthMethodClientSecretPost when the server advertises it or advertises nothing at all; otherwise TokenEndpointClient.AuthMethodClientSecretBasic.

Exceptions

Exception	Description
`ArgumentNullException`	Thrown when metadata is `null`.

Remarks

Public because the caller has to persist the same method on the TokenContainer it stores, so a later silent re-acquisition authenticates exactly the way the first one did.

ToString Inherited Virtual

Inherited from object

Syntax

public virtual string ToString()

Returns

Type: string?

​Definition

​Syntax

​Summary

​Remarks

​Examples

​Constructors

​ .ctor

​Syntax

​Parameters

​Exceptions

​ .ctor Inherited

​Syntax

​Methods

​ AcquireAsync

​Syntax

​Parameters

​Returns

​Exceptions

​Examples

​ Equals Inherited Virtual

​Syntax

​Parameters

​Returns

​ Equals Inherited

​Syntax

​Parameters

​Returns

​ GetHashCode Inherited Virtual

​Syntax

​Returns

​ GetType Inherited

​Syntax

​Returns

​ MemberwiseClone Inherited

​Syntax

​Returns

​ ReferenceEquals Inherited

​Syntax

​Parameters

​Returns

​ ResolveAuthMethod

​Syntax

​Parameters

​Returns

​Exceptions

​Remarks

​ ToString Inherited Virtual

​Syntax

​Returns

Definition

Syntax

Summary

Remarks

Examples

Constructors

.ctor

Syntax

Parameters

Exceptions

.ctor Inherited

Syntax

Methods

AcquireAsync

Syntax

Parameters

Returns

Exceptions

Examples

Equals Inherited Virtual

Syntax

Parameters

Returns

Equals Inherited

Syntax

Parameters

Returns

GetHashCode Inherited Virtual

Syntax

Returns

GetType Inherited

Syntax

Returns

MemberwiseClone Inherited

Syntax

Returns

ReferenceEquals Inherited

Syntax

Parameters

Returns

ResolveAuthMethod

Syntax

Parameters

Returns

Exceptions

Remarks

ToString Inherited Virtual

Syntax

Returns