Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-31 09:12:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish JwtGrantedAuthoritiesConverter

Browse Source 
Rework the implementation so that it is clearer that authorities are
derived from a single claim.

Issue: gh-6273
This commit is contained in:
Josh Cummings 2019-08-02 14:35:44 -06:00
parent 09a119978c
commit d843818e48
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
1 changed files with 34 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java
View File

@ -16,10 +16,10 @@
package org.springframework.security.oauth2.server.resource.authentication; package org.springframework.security.oauth2.server.resource.authentication;
import java.util.ArrayList;
import java.util.Arrays; import java.util.Arrays;
import java.util.Collection; import java.util.Collection;
import java.util.Collections; import java.util.Collections;
import java.util.stream.Collectors;
import org.springframework.core.convert.converter.Converter; import org.springframework.core.convert.converter.Converter;
import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.GrantedAuthority;
@ -35,43 +35,52 @@ import org.springframework.util.StringUtils;
* @since 5.2 * @since 5.2
*/ */
public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Collection<GrantedAuthority>> { public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Collection<GrantedAuthority>> {
private static final String SCOPE_AUTHORITY_PREFIX = "SCOPE_"; private static final String DEFAULT_AUTHORITY_PREFIX = "SCOPE_";
private static final Collection<String> WELL_KNOWN_SCOPE_ATTRIBUTE_NAMES = private static final Collection<String> WELL_KNOWN_AUTHORITIES_CLAIM_NAMES =
Arrays.asList("scope", "scp"); Arrays.asList("scope", "scp");
/** /**
* Extracts the authorities * Extract {@link GrantedAuthority}s from the given {@link Jwt}.
*
* @param jwt The {@link Jwt} token * @param jwt The {@link Jwt} token
* @return The {@link GrantedAuthority authorities} read from the token scopes * @return The {@link GrantedAuthority authorities} read from the token scopes
*/ */
@Override @Override
public Collection<GrantedAuthority> convert(Jwt jwt) { public Collection<GrantedAuthority> convert(Jwt jwt) {
return getScopes(jwt) Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
.stream() for (String authority : getAuthorities(jwt)) {
.map(authority -> SCOPE_AUTHORITY_PREFIX + authority) grantedAuthorities.add(new SimpleGrantedAuthority(DEFAULT_AUTHORITY_PREFIX + authority));
.map(SimpleGrantedAuthority::new) }
.collect(Collectors.toList()); return grantedAuthorities;
} }
/** private String getAuthoritiesClaimName(Jwt jwt) {
* Gets the scopes from a {@link Jwt} token for (String claimName : WELL_KNOWN_AUTHORITIES_CLAIM_NAMES) {
* @param jwt The {@link Jwt} token if (jwt.containsClaim(claimName)) {
* @return The scopes from the token return claimName;
*/
private Collection<String> getScopes(Jwt jwt) {
for ( String attributeName : WELL_KNOWN_SCOPE_ATTRIBUTE_NAMES ) {
Object scopes = jwt.getClaims().get(attributeName);
if (scopes instanceof String) {
if (StringUtils.hasText((String) scopes)) {
return Arrays.asList(((String) scopes).split(" "));
} else {
return Collections.emptyList();
}
} else if (scopes instanceof Collection) {
return (Collection<String>) scopes;
} }
} }
return null;
}
private Collection<String> getAuthorities(Jwt jwt) {
String claimName = getAuthoritiesClaimName(jwt);
if (claimName == null) {
return Collections.emptyList();
}
Object authorities = jwt.getClaim(claimName);
if (authorities instanceof String) {
if (StringUtils.hasText((String) authorities)) {
return Arrays.asList(((String) authorities).split(" "));
} else {
return Collections.emptyList();
}
} else if (authorities instanceof Collection) {
return (Collection<String>) authorities;
}
return Collections.emptyList(); return Collections.emptyList();
} }