Yes, I read the docs you mentioned. In fact those docs pointed me to our current solution. We are sending the Gluu client id and secret in the `Authorization: Basic` header and the user credentials in the body. This is the python code I use for testing:
```python
import requests
session = requests.session()
post = {
'grant_type': 'password',
'username': USERNAME,
'password': PASSWORD,
'scope': 'openid email profile',
}
response = session.post(
auth=requests.auth.HTTPBasicAuth(
username=CLIENT_ID,
password=CLIENT_SECRET),
headers={'Content-Type': 'application/x-www-form-urlencoded'},
url=ACCESS_TOKEN_ENDPOINT,
verify=False,
data=post
)
```
In the custom authentication script, our authenticate method looks as follows. `idp_requests` is a small python library we wrote that communicates between Gluu and our own IdP.
```python
def authenticate(self, configurationAttributes, requestParameters, step):
if step == 1:
credentials = Identity.instance().getCredentials()
username = credentials.getUsername()
password = credentials.getPassword()
if StringHelper.isEmpty(username) or StringHelper.isEmpty(password):
print "[CUSTOM_AUTH] Username or password empty"
return False
if not idp_requests.check_credentials(username, password, configurationAttributes):
print "[CUSTOM_AUTH] Login failed for username {}".format(username)
return False
...
```
Gluu does hit our custom script, but the `idp_requests.check_credentials` call fails. The log message is `[CUSTOM_AUTH] Login failed for username CLIENT_ID`
On a side note, if I use invalid credentials in the header, the wrapper.log shows `INFO [org.xdi.oxauth.auth.AuthenticationFilter] Basic authentication failed`, which is as expected.