Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add configurable authorities split regex 

Before this commit splitting the authorities claim was done by a
hardcoded regex " ". This commit allows to configure to set any regex
to split the authorities claim while keeping the previously
hardcoded regex as a default.
This commit is contained in:
Patrick Walter 2022-10-22 11:45:19 +02:00 committed by Josh Cummings
parent cca999c57d
commit e93ed6d94c
2 changed files with 33 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2018 the original author or authors. * Copyright 2002-2022 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -45,10 +45,14 @@ public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Coll
private static final String DEFAULT_AUTHORITY_PREFIX = "SCOPE_"; private static final String DEFAULT_AUTHORITY_PREFIX = "SCOPE_";
private static final String DEFAULT_AUTHORITIES_SPLIT_REGEX = " ";
private static final Collection<String> WELL_KNOWN_AUTHORITIES_CLAIM_NAMES = Arrays.asList("scope", "scp"); private static final Collection<String> WELL_KNOWN_AUTHORITIES_CLAIM_NAMES = Arrays.asList("scope", "scp");
private String authorityPrefix = DEFAULT_AUTHORITY_PREFIX; private String authorityPrefix = DEFAULT_AUTHORITY_PREFIX;
private String authoritiesSplitRegex = DEFAULT_AUTHORITIES_SPLIT_REGEX;
private String authoritiesClaimName; private String authoritiesClaimName;
/** /**
@ -77,6 +81,18 @@ public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Coll
this.authorityPrefix = authorityPrefix; this.authorityPrefix = authorityPrefix;
} }
/**
* Sets the regex to use for splitting the value of the authorities claim into
* {@link GrantedAuthority authorities}. Defaults to
* {@link JwtGrantedAuthoritiesConverter#DEFAULT_AUTHORITIES_SPLIT_REGEX}.
* @param authoritiesSplitRegex The regex used to split the authorities
* @since 6.1
*/
public void setAuthoritiesSplitRegex(String authoritiesSplitRegex) {
Assert.notNull(authoritiesSplitRegex, "authoritiesSplitRegex cannot be null");
this.authoritiesSplitRegex = authoritiesSplitRegex;
}
/** /**
* Sets the name of token claim to use for mapping {@link GrantedAuthority * Sets the name of token claim to use for mapping {@link GrantedAuthority
* authorities} by this converter. Defaults to * authorities} by this converter. Defaults to
@ -113,7 +129,7 @@ public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Coll
Object authorities = jwt.getClaim(claimName); Object authorities = jwt.getClaim(claimName);
if (authorities instanceof String) { if (authorities instanceof String) {
if (StringUtils.hasText((String) authorities)) { if (StringUtils.hasText((String) authorities)) {
return Arrays.asList(((String) authorities).split(" ")); return Arrays.asList(((String) authorities).split(this.authoritiesSplitRegex));
} }
return Collections.emptyList(); return Collections.emptyList();
} }

16
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverterTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2018 the original author or authors. * Copyright 2002-2022 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -256,4 +256,18 @@ public class JwtGrantedAuthoritiesConverterTests {
assertThat(authorities).isEmpty(); assertThat(authorities).isEmpty();
} }
@Test
public void convertWithCustomAuthoritiesSplitRegexWhenTokenHasScopeAttributeThenTranslatedToAuthorities() {
// @formatter:off
Jwt jwt = TestJwts.jwt()
.claim("scope", "message:read,message:write")
.build();
// @formatter:on
JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthoritiesSplitRegex(",");
Collection<GrantedAuthority> authorities = jwtGrantedAuthoritiesConverter.convert(jwt);
assertThat(authorities).containsExactly(new SimpleGrantedAuthority("SCOPE_message:read"),
new SimpleGrantedAuthority("SCOPE_message:write"));
}
} }