DefaultOAuth2RequestAuthenticator should use Bearer

[jgrandja]

DefaultOAuth2RequestAuthenticator should ensure the Authorization request header uses the Bearer scheme. The current implementation uses OAuth2AccessToken.getTokenType() as-is and if available, which in certain scenarios may be bearer.

As per RFC6750:

The syntax for Bearer credentials is as follows:
b64token = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) "="
credentials = "Bearer" 1SP b64token

OAuth2AccessToken.getTokenType() is derived by the token_type parameter returned in the Token Response. This should not be used as the authentication scheme for the Authorization Request header.

The fix here is to ensure that DefaultOAuth2RequestAuthenticator uses Bearer as the authentication scheme.

We should also consider changing the default for DefaultOAuth2AccessToken.tokenType which currently is OAuth2AccessToken.BEARER_TYPE.toLowerCase(). However, this is a non-passive change and will likely break current implementations so it may have to wait for a minor release.

[issmith1]

RE: in certain scenarios may be bearer
Can you please clarify "scenarios"? Are these scenarios driven by the dependency tree / Spring configurations? or data/environment?