kinetic_sdk 7.0.0.rc4 → 7.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ab81a960e1aebbf2e7cd839fdf3fd60c33ca71e985e0c6530c7e84ca8e8ec6f
-  data.tar.gz: d485a88f2085aa142c0015c2899999d46c403f66b8b460efffb0918730ca51aa
+  metadata.gz: 3fb9f7ab44be718c7df520bdb50bf97e0b33d184340d610608393ab9847834a0
+  data.tar.gz: d8331e8aeefdf808cc55ff2546df6e8edacde76835300d733b32f1cd72eb528b
 SHA512:
-  metadata.gz: dbd1dbf0607dc20f54e2cbea981496d1fbc8088c8b00fa8ce6483317577fe15bff2b8ae3328d7e797506dea4db66a9cc5c6d3b3ca491bdc99a0ff6fd144e9725
-  data.tar.gz: 86092ddc85c919ace2d1bb3133c8feb9aa320969162e471cc100617b81fef05fa0dc5b644c770dbb1a41ebc8c4b6e8aa53586bcc31463b966caef2fb44aa74fe
+  metadata.gz: ef422ca2c44ff3b50d13de5a01aeb2c72bd3f1fd76797979da7e30668183591c8919d7d3d3a958db6dfe77010414bcf182ec72fbc108db9c3e875fde249fae2b
+  data.tar.gz: 93edce1847353966e76ef873ab96969dafcadf47ea923f13a492a8def392c6933700d0a44b22d1e790fa956d36ded1abe77bd3c8e4d9d3aa6e4b64f663f95f13

data/CHANGELOG.md

@@ -1,6 +1,31 @@
 # Change Log
 
 
+## [7.0.0.rc5](https://github.com/kineticdata/kinetic-sdk-rb/tree/7.0.0.rc5) (2026-09-01)
+
+**Fixed bugs:**
+
+- Fixed `401 invalid_client` when retrieving a JWT with a client secret containing `+`, `%`
+  or a space, despite correct credentials. The token request now authenticates with
+  `client_secret_post`, sending `client_id` and `client_secret` as form parameters.
+
+  `client_secret_basic` requires both values to be form-urlencoded before base64 encoding
+  (RFC 6749 section 2.3.1), and Spring Authorization Server's
+  `ClientSecretBasicAuthenticationConverter` correspondingly URL-decodes them. The SDK sent
+  them raw, so a `+` in a secret was decoded to a space and the bcrypt comparison failed.
+  Kinetic Coordinator generates integration user passwords from a character set containing
+  `+`, which is why the failure appeared intermittently across tenants.
+
+  `header_basic_auth` is deliberately unchanged. It is shared by every ordinary HTTP Basic
+  user authentication call site, and Core authenticates those with Spring Security's
+  `BasicAuthenticationConverter`, which does not URL-decode. Adding encoding there would
+  break any user whose password contains `+` or `%`.
+
+- The token request no longer sends an Authorization header, and strips any header inherited
+  from the caller, so it cannot compete with the form credentials. This also keeps the client
+  secret out of the SDK's debug log, which prints request headers.
+
+
 ## [7.0.0.rc4](https://github.com/kineticdata/kinetic-sdk-rb/tree/7.0.0.rc4) (2026-09-01)
 
 **Breaking changes:**

data/lib/kinetic_sdk/core/lib/jwt.rb

@@ -14,24 +14,39 @@ module KineticSdk
     # `client_credentials` grant. Public clients and the built in system client support
     # only `authorization_code`, and will be rejected here.
     #
+    # The client authenticates with `client_secret_post`, sending its credentials as form
+    # parameters rather than in an Authorization header. `client_secret_basic` requires the
+    # credentials to be form-urlencoded before base64 encoding (RFC 6749 section 2.3.1), which
+    # the shared `header_basic_auth` helper does not do - and must not start doing, because
+    # ordinary HTTP Basic user authentication takes credentials raw. A secret containing "+"
+    # would otherwise reach the server with that "+" decoded to a space.
+    #
     # @param client_id [String] the oauth client id
     # @param client_secret [String] the oauth client secret
-    # @param headers [Hash] additional headers to send. The Accept, Authorization and
-    #   Content-Type headers required by the token endpoint always take precedence.
+    # @param headers [Hash] additional headers to send. The Accept and Content-Type headers
+    #   required by the token endpoint always take precedence, and any Authorization header
+    #   is removed so it cannot compete with the form credentials.
     # @param scope [String] scope to request, defaults to the +:oauth_scope+ option (+full+)
     # @return [KineticSdk::Utils::KineticHttpResponse] object, with +code+, +message+, +content_string+, and +content+ properties
     def jwt_token(client_id, client_secret, headers = {}, scope = oauth_scope)
       @logger.info("Retrieving JWT authorization token")
       url = "#{@oauth_url}/token"
 
-      # The required headers are merged last so that a caller passing the SDK default
-      # headers cannot replace the client's basic authentication with the user's.
+      # The required headers are merged last so a caller cannot override them. Any inherited
+      # Authorization header (the SDK user's basic auth, for instance) is dropped: the
+      # authorization server would read it as a competing client authentication.
       token_headers = headers
         .merge(header_accept_json)
-        .merge(header_basic_auth(client_id, client_secret))
         .merge({ "Content-Type" => "application/x-www-form-urlencoded" })
+      token_headers.delete_if { |key, _value| key.to_s.casecmp("authorization").zero? }
 
-      payload = { "grant_type" => "client_credentials" }
+      # URI.encode_www_form applies the same application/x-www-form-urlencoded rules the
+      # server decodes with, so "+", "%", ":" and spaces in a secret survive the round trip.
+      payload = {
+        "grant_type" => "client_credentials",
+        "client_id" => client_id,
+        "client_secret" => client_secret,
+      }
       payload["scope"] = scope unless scope.nil? || scope.to_s.empty?
 
       # Redirects are not followed: the token endpoint has no reason to redirect, and

data/lib/kinetic_sdk/version.rb

@@ -3,5 +3,5 @@ module KineticSdk
   # Version of Kinetic SDK
   #
   # @return [String] Version of the SDK
-  VERSION = "7.0.0.rc4"
+  VERSION = "7.0.0.rc5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kinetic_sdk
 version: !ruby/object:Gem::Version
-  version: 7.0.0.rc4
+  version: 7.0.0.rc5
 platform: ruby
 authors:
 - Kinetic Data
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: slugify