feat: `authz-casdoor` should support fetching access token using username and password about apisix

[shreemaan-abhishek]

I find it difficult to understand your problem. Right now, it seems that you are trying to use a feature from Casdoor but it doesn't work.

Are there any error logs?
Is APISIX missing some configuration parameters?
?

[edyan]

Hello and thanks for your answer

The Resource Owner Password Credentials (ROPC) grant flow lets the client use the resource owner's user name and password to get an access token.

I have an API behind APISIX. APISIX check the authentication via Casdoor. When a user wants to get a token for the API, it goes to Casdoor, request a token by providing a client_id, username and password.

I would like to hide the client_id and that the user only provides his username / password. Exactly like what the keycloak plugin does : https://apisix.apache.org/docs/apisix/3.1/plugins/authz-keycloak/#generating-a-token-using-password-grant

Is it something I need to code myself or is it something that apisix is able to natively handle ?

Thanks

[shreemaan-abhishek]

I have minimal experience in working with the casdoor/keycloak/oidc plugins but I can confirm that client-secret is a required field for authz-casdoor plugin.

https://github.com/shreemaan-abhishek/apisix/blob/07b3cc3f63db8fc4ae3706baa324a76ee3049338/apisix/plugins/authz-casdoor.lua#L36-L38

is it something that apisix is able to natively handle ?

No APISIX doesn't yet support this.