fetch_token() is broken for BackendApplicationClient (InvalidClientError)

[KKomarov]

Looks like some breaking changes happen between 1.1.0 and 1.2.0 because now an example from the docs is not working. It crashes with InvalidClientError error.

from oauthlib.oauth2 import BackendApplicationClient
from requests_oauthlib import OAuth2Session
client_id = 'your_client_id'
client_secret = 'your_client_secret'
tenant_id = 'your_tenant_id'

client = BackendApplicationClient(client_id=client_id)
oauth = OAuth2Session(client=client)
token = oauth.fetch_token(
    token_url='https://login.microsoftonline.com/%s/oauth2/token' % tenant_id,
    client_id=client_id,
    client_secret=client_secret,
    # include_client_id=True,  # it fixes the problem
    resource='https://vault.azure.net'
)
print(token)

I found that now to fix it we need to specify new param include_client_id to True. Without this flag fetch_token tries to get token using basic auth instead of client_credentials flow.

It actualy comes from azure sdk for python 2.0.0 which uses msrestazure which uses requests-oauthlib https://github.com/Azure/msrestazure-for-python/blob/e347fc59d323edccf04ce9a043768ce4d36b6271/msrestazure/azure_active_directory.py#L471

Is possible to make default behavior as previously and pass client_secret to a body if it present? b3c227a#diff-2285f48ccef10fe187361b98f119ee1fR264

[akeeman]

#357 breaks this. Oauthlib 3.x doesn't accept None for include_client_id params, where 2.x did, and this repo relies on that.