Client Credentials Flow & UserManager.signinResourceOwnerCredentials()

[roubert]

[I'm quite unsure whether this ends up being a support request, feature request or bug report, but please bear with me.]

I'm using the oidc-client-ts library in Node.js server code to access services from https://digital.swisscom.com/ and it all works fine (thank you, I like your library), but I have some questions. Their documentation doesn't seem to be public, but the part that's relevant here is very short, only a code example, so I'll just copy-paste it:

CLIENT_ID=<client id> &&
CLIENT_SECRET=<client secret> &&
OAUTH_TOKEN_URL=https://api.swisscom.com/oauth2/token &&
/usr/bin/curl -Ssv \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Content-Length: 0" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -X POST "$OAUTH_TOKEN_URL?grant_type=client_credentials"

In order to perform that operation, I have written the following code:

const CLIENT_ID = // …
const CLIENT_SECRET = // …
const OAUTH_TOKEN_URL = 'https://api.swisscom.com/oauth2/token';

manager = new oidc.UserManager({
  authority: '',
  metadata: {
    token_endpoint: OAUTH_TOKEN_URL,
  },
  client_id: CLIENT_ID,
  client_secret: CLIENT_SECRET,
  scope: '',
  redirect_uri: '',
  client_authentication: 'client_secret_basic',
  extraTokenParams: {
    grant_type: 'client_credentials',
  },
});

user = await manager.signinResourceOwnerCredentials({
  password: '',
  username: '',
});

That code results in the following payload being sent to the server in the POST request:

grant_type=client_credentials&scope=&username=&password=

And that all works fine, I receive a response with a valid access_token, but I wonder:

1. Is signinResourceOwnerCredentials() really the correct function to use here, or would it somehow be better to do this in some other way instead?

• In case that really is the correct function, what's then up with the mandatory password and username parameters here? Even if it's harmless, it seems a bit odd to me that they're required by the function signature and that they're being included in the POST request when they're empty.

2. I don't want to send the default scope in the request so I specify the empty string to override the default, which works fine, but it seems rather odd to me to include the parameter with an empty value in the POST request instead of simply omitting it. Is this intentional, or possibly an oversight?

3. The authority and redirect_uri parameters are required by the function signature but as far as I can tell they're not actually used for anything here. Maybe authority is actually used for something under the hood that I haven't noticed yet (would it be useful to set it to something?), but I really can't imagine that redirect_uri would be used for anything here. Should these really be required?

Thanks!