Skip authentication for direct POST on endpoint

[brat002]

Description of the Change

The solution fixes a problem of automation when user should get an authorization code to send it to a client to exchange to token(hashikorp vault in example).

curl -k -vvv -sXPOST "http://127.0.0.1:8000/authorize/"  -d"grant_type=authorization_code&response_type=code&client_id=testvault&username=xxx&password=xxx&redirect_uri=http://127.0.0.1:8000&scope=openid profile&allow=1"

will look like

curl -k -vvv -sXPOST "http://127.0.0.1:8000/authorize/"  -d"grant_type=authorization_code&response_type=code&client_id=testvault&username=xxx&password=xxx&redirect_uri=http://127.0.0.1:8000&scope=openid profile"

as it should.

Checklist

• PR only contains one change (considered splitting up PR)
• unit-test added
• documentation updated
• CHANGELOG.md updated (only for user relevant changes)
• author name in AUTHORS

[codecov]

Codecov Report

Attention: Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.

Project coverage is 97.50%. Comparing base (e15e245) to head (4c24d8e).
Report is 67 commits behind head on master.

Files with missing lines	Patch %	Lines
oauth2_provider/views/base.py	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1034      +/-   ##
==========================================
- Coverage   97.54%   97.50%   -0.05%     
==========================================
  Files          32       32              
  Lines        2120     2122       +2     
==========================================
+ Hits         2068     2069       +1     
- Misses         52       53       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[n2ygk]

Can you please cite where in the OAuth 2.0 RFCs this added allow parameter is permitted?

[dopry]

@n2ygk allow is actually the result of the DOT AllowForm when authorization is requested this will have the value the user clicked.

[dopry]

@brat002 thanks for creating this PR! We need to tick two boxes before we can merge this.

1. Can you clarify your use case? While I know the allow is from our form, I want to be sure I understand the flow you're going for here. Wouldn't setting skip authorization on the application resolve this for you?
2. We'll need tests for these changes before we can merge it.

[dopry]

@brat002 do you still have the time or inclination to finish working on this PR?

[n2ygk]

Closing as stale