Deprecate password grant

[jankapunkt]

The password grant type is considered deprecated:

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics

[jorenvandeweyer]

How would you implement this deprecation? I think we should not delete the grant type.

Maybe we can create a option parameter that needs to be explicitely set allowDeprecatedGrantTypes to true to use the password grant type. When the password grant type is used we can throw an error mentioning it needs to be set to true to be used?

[jankapunkt]

Yes something like that so we keep backwards compat but also raise awareness for the topic. Finally it's the user's decision

[jankapunkt]

I am about to implement this, however the scenario you @jorenvandeweyer described is already breaking for current users.
Should we raise a warning instead for now, mentioning it will become deprecated in future (major) versions and also refer to the security draft in the link?

[jorenvandeweyer]

Yeah after I wrote this, I got the same thought.

Raising a warning by logging it would be much better. With the option parameter the warning would be suppressed.