b3282957a8
Add OAuth2AuthorizationException
2018-09-11 14:53:42 -05:00
26e577b0fa
UnauthenticatedServerOAuth2AuthorizedClientRepository->UnAuthenticatedServerOAuth2AuthorizedClientRepository
...
Issue: gh-5817
2018-09-07 15:29:35 -05:00
11ea92ef1c
Add UnauthenticatedServerOAuth2AuthorizedClientRepository
...
Fixes: gh-5817
2018-09-07 15:28:40 -05:00
9e0f171d47
Jwt Claim Mapping
...
This introduces a hook for users to customize standard Jwt Claim
values in cases where the JWT issuer isn't spec compliant or where the
user needs to add or remove claims.
Fixes: gh-5223
2018-09-07 09:48:26 -05:00
438d2911fb
OAuth2AuthorizedClientResolver
...
Extract out a private API for shared code between the argument resolver
and WebClient support. This makes it easier to make changes in both
locations. Later we will extract this out so it is not a copy/paste
effort.
Issue: gh-4921
2018-09-07 08:58:00 -05:00
23726abb1e
ServerOAuth2AuthorizedClientExchangeFilterFunction default ServerWebExchange
...
Leverage ServerWebExchange established by ServerWebExchangeReactorContextWebFilter
Issue: gh-4921
2018-09-07 08:57:25 -05:00
ac78258847
ServerOAuth2AuthorizedClientExchangeFilterFunction defaultOAuth2AuthorizedClient
...
Defaults to use the OAuth2AuthenticationToken to resolve the authorized client
Issue: gh-4921
2018-09-07 08:57:00 -05:00
158b8aa6d5
ServerOAuth2AuthorizedClientExchangeFilterFunction clientRegistrationId
...
Issue: gh-4921
2018-09-07 08:56:49 -05:00
28537fa3b6
WebClientReactiveClientCredentialsTokenResponseClient
...
Fixes: gh-5607
2018-09-07 08:53:35 -05:00
89f2874bff
ServerOAuth2AuthorizedClientExchangeFilterFunction clientRegistrationId
...
You can now provide the clientRegistrationId and
ServerOAuth2AuthorizedClientExchangeFilterFunction will look up the authorized client automatically.
Issue: gh-4921
2018-09-07 08:52:35 -05:00
5bcbb1c40f
ServerOAuth2AuthorizedClientExchangeFilterFunction uses ServerOAuth2AuthorizedClientRepository
...
Issue: gh-4921
2018-09-07 08:52:18 -05:00
65c81ce952
Make JwtReactiveAuthenticationManager final
2018-09-06 13:46:18 -06:00
057587ef29
ClientRegistration contains Provider Configuration Metadata
...
Fixes gh-5540
2018-09-05 17:01:23 -04:00
dfd572a4d2
Polish
2018-09-05 07:59:00 -05:00
3b480a3a05
Provide RestOperations in CustomUserTypesOAuth2UserService
...
Fixes gh-5602
2018-09-05 07:59:00 -05:00
4a8c95a3e8
Provide RestOperations in DefaultOAuth2UserService
...
Fixes gh-5600
2018-09-05 07:59:00 -05:00
8510e9a285
Reactive Resource Server insufficient_scope
...
This introduces an implementation of ServerAccessDeniedHandler that is
compliant with the OAuth 2.0 spec for insufficent_scope errors.
Fixes: gh-5705
2018-08-31 10:33:11 -05:00
8e615d0fee
Re-factor DefaultClientCredentialsTokenResponseClient
...
Fixes gh-5735
2018-08-27 15:10:17 -05:00
713e1e3356
BearerTokenServerAuthenticationEntryPoint waits for subscriber
...
Fixes: gh-5742
2018-08-27 14:26:45 -05:00
229b69dd35
Add DefaultAuthorizationCodeTokenResponseClient
...
Fixes gh-5547
2018-08-27 12:44:19 -04:00
f5ad4ba0fa
ServletOAuth2AuthorizedClientExchangeFilterFunction support client_credentials
...
Fixes: gh-5639
2018-08-24 11:33:02 -05:00
2d497c7b0f
Remove OAuth2ExchangeFilterFunctions
...
Fixes: gh-5734
2018-08-24 11:27:59 -05:00
59cdfc7d6e
ReactiveJwtDecoder via OIDC Provider Configuration
...
A reactive static builder for constructing and configuring a
ReactiveJwtDecoder via an issuer that supports the OIDC Provider
Configuration spec.
Fixes: gh-5649
2018-08-21 15:09:18 -05:00
01443e35b4
Reactive Jwt Validation
...
This allows a user to customize the Jwt validation steps that
NimbusReactiveJwtDecoder will take for each Jwt.
Fixes: gh-5650
2018-08-21 15:06:05 -05:00
b11e9ed317
Fix Javadoc Typo
...
NimbusReactiveJwtDecoder incorrectly referred in its class-level doc
as being an implementation of JwtDecoder. This has been corrected to
say ReactiveJwtDecoder.
Fixes: gh-5711
2018-08-21 12:21:23 -06:00
3cd0ebedc9
Polish ClientRegistrations
...
Class is now final
Issue: gh-5647
2018-08-20 10:54:53 -06:00
85d5d4083f
Add ServerOAuth2AuthorizationRequestResolver
...
Fixes: gh-5610
2018-08-19 21:13:54 -05:00
b9ab4929b7
Add OAuth2AuthorizationCodeGrantWebFilter
...
Issue: gh-5620
2018-08-19 21:12:41 -05:00
d0ebe47cd5
OAuth2LoginReactiveAuthenticationManager uses OAuth2AuthorizationCodeReactiveAuthenticationManager
...
Issue: gh-5620
2018-08-19 21:12:32 -05:00
8b67154e77
Add OAuth2AuthorizationCodeReactiveAuthenticationManager
...
Issue: gh-5620
2018-08-19 21:12:06 -05:00
f843da1942
Add OAuth2LoginAuthenticationWebFilter
...
This is necessary so that the saving of the authorized client occurs
outside of the ReactiveAuthenticationManager. It will allow for
saving with the ServerWebExchange when ReactiveOAuth2AuthorizedClientRepository
is added.
Issue: gh-5621
2018-08-19 21:11:43 -05:00
dd7925cb63
OAuth2AuthorizedClientArgumentResolver Uses ServerOAuth2AuthorizedClientRepository
...
Issue: gh-5621
2018-08-19 21:11:24 -05:00
1d57a084aa
Add ServerOAuth2AuthorizedClientRepository
...
Fixes: gh-5621
2018-08-19 21:10:15 -05:00
3a7083c7e9
Add Test<DomainObject>s For OAuth2
...
Fixes: gh-5699
2018-08-19 21:08:28 -05:00
b02ce59188
TestClientRegistrations
...
Fixes: gh-5651
2018-08-19 21:08:02 -05:00
5ddb25fff8
Consistent .server package for ServerWebExchange OAuth2
...
Fixes: gh-5663
2018-08-19 21:05:55 -05:00
e3eaa99ad0
Polish ServerAuthenticationConverter
...
Update changes for ServerAuthenticationConverter to be passive.
Issue: gh-5338
2018-08-18 19:55:39 -05:00
b6afe66d32
Add ServerAuthenticationConverter interface
...
- Adding an ServerAuthenticationConverter interface
- Retro-fitting ServerOAuth2LoginAuthenticationTokenConverter,
ServerBearerTokenAuthentivationConverter, ServerFormLoginAuthenticationConverter,
and ServerHttpBasicAuthenticationConverter to implement ServerAuthenticationConverter
- Deprecate existing AuthenticationWebFilter.setAuthenticationConverter
and add overloaded one which takes ServerAuthenticationConverter
Fixes gh-5338
2018-08-18 19:55:39 -05:00
2e620a26de
Auto-configure JwtDecoder via OpenId Configuration
...
Adding JwtDecoders#fromOidcIssuerLocation which takes an issuer
and derives from it the jwk set uri via a call to
.well-known/openid-configuration
Fixes: gh-5523
2018-08-17 11:20:26 -05:00
d610f31425
Jwt -> Authentication Conversion
...
Exposes ability to specify a strategy for converting Jwt into an
Authentication, specifically in JwtAuthenticationProvider.
Fixes: gh-5629
2018-08-17 11:04:27 -05:00
938dbbf424
Add OAuth2AuthorizationRequestResolver.resolve(HttpServletRequest,String)
...
Previously there was a tangle between
DefaultOAuth2AuthorizationRequestResolver and
OAuth2AuthorizationRequestRedirectFilter with
AUTHORIZATION_REQUIRED_EXCEPTION_ATTR_NAME
This commit adds a new method that can be used for resolving the
OAuth2AuthorizationRequest when the client registration id is known.
Issue: gh-4911
2018-08-16 20:41:13 -05:00
06df562d61
Polish JwtValidators
...
The current name of createDelegatingJwtValidator is not intuitive. The
name implies it is just creating a DelegatingOAuth2TokenValidator with
no mention that JwtTimestampValidator is being added.
To resolve this, the arguments have been removed and only
JwtTimestampValidator is added. User's needing additional validators can
add the result of this method to DelegatingOAuth2TokenValidator along with
the additional validators they wish to use. The method name has been
renamed to createDefault which now accurately reflects what is created.
There is no need to have JwtValidator at the end of the method since
the method is located in JwtValidators.
The commit also adds createDefaultWithIssuer for creating with a specific issuer.
Issue: gh-5133
2018-08-16 13:21:07 -05:00
7c524aa0c8
Jwt Claim Validation
...
This introduces OAuth2TokenValidator which allows the customization of
validation steps that need to be performing when decoding a string
token to a Jwt.
At this point, two validators, JwtTimestampValidator and
JwtIssuerValidator, are available for use.
Fixes: gh-5133
2018-08-16 13:19:26 -05:00
a4bd0d3923
OIDC Provider Configuration - ClientRegistrations
...
OIDC Provider Configuration is now being used to create more than just
ClientRegistration instances. Also, the endpoint is being addressed in
more contexts than just the client.
To that end, this refactors OidcConfigurationProvider in the config
project to ClientRegistrations in the oauth2-client project.
Fixes: gh-5647
2018-08-14 13:26:46 -06:00
cbdc7ee4b3
Relax validation on ClientRegistration
...
Fixes gh-5667
2018-08-14 14:05:45 -04:00
010d99a7d0
Make ClientRegistration.clientSecret optional
...
Fixes gh-5652
2018-08-14 13:32:51 -04:00
8a0c6868cd
Add additional parameters to OAuth2UserRequest
...
Fixes gh-5368
2018-08-14 05:14:45 -04:00
68878a1675
Replace isEqualTo(null) with isNull()
2018-08-09 18:04:48 -06:00
16fe1c5b52
Expose RestOperations in NimbusJwtDecoderJwkSupport
...
Fixes gh-5603
2018-08-08 14:49:46 -04:00
11984039c2
Add OidcUserService.setOauth2UserService()
...
Fixes gh-5604
2018-08-08 09:32:47 -04:00
952743269d
Add support for client_credentials grant
...
Fixes gh-4982
2018-08-08 08:06:47 -05:00
3d1185df3b
Add @Deprecation on removeAuthorizationRequest() ( #5634 )
2018-08-03 09:37:48 -04:00
1a65abd781
Add defaultOAuth2AuthorizedClient flag
...
Fixes: gh-5619
2018-07-31 14:44:40 -05:00
2cd2bab818
Use HttpHeaders.setBasicAuth
...
Issue: gh-5612
2018-07-30 15:34:48 -05:00
afa2d9cbc7
Remove ExchangeFilterFunctions
...
Issue: gh-5612
2018-07-30 15:34:44 -05:00
262c1a77c6
Remove SecurityHeaders
...
We no longer need this since Spring Framework now provides
HttpHeaders.setBearerAuth
Issue: gh-5612
2018-07-30 15:34:40 -05:00
b5abb99908
ClaimAccessor.getClaimAsString() checks null claim value
...
Fixes gh-5608
2018-07-30 15:31:41 -04:00
e243f93eed
Default to server_error when OAuth2Error.errorCode is null
...
Fixes gh-5594
2018-07-30 13:20:58 -04:00
aea861e2f9
Fix Imports
...
Issue: gh-5599
2018-07-30 12:15:53 -05:00
a01dc3a5f6
WebFlux Handles Undefined State Parameter
...
Currently if a state exists, but an undefined state parameter is provided
a NullPointerException occurs.
This commit handles the null value.
Fixes: gh-5599
2018-07-30 12:02:42 -05:00
2056b3440f
Add ServerBearerTokenAuthenticationConverter
...
Issue: gh-5605
2018-07-30 11:39:40 -05:00
4f417f01a7
BearerTokenServerAuthenticationEntryPoint
...
Issue: gh-5605
2018-07-30 11:39:34 -05:00
da73242d60
Add JwtReactiveAuthenticationManager
...
Issue: gh-5605
2018-07-30 11:39:28 -05:00
b8308c9ae0
Extract JwtConverter
...
Issue: gh-5605
2018-07-30 11:37:56 -05:00
f3c9cce56d
Rename to WebClientAuthorizationCodeTokenResponseClient
...
Rename NimbusReactiveAUthorizationCodeTokenResponseClient to
WebClientReactiveAuthorizationCodeTokenResponseClient
Fixes: gh-5529
2018-07-26 15:14:11 -05:00
1c8a931e33
Rename to OidcAuthorizationCodeReactiveAuthenticationManager
...
Renamed OidcReactiveAuthenticationManager to
OidcAuthorizationCodeReactiveAuthenticationManager since it only handles
authorization code flow.
Fixes: gh-5530
2018-07-26 15:14:11 -05:00
2c1c2c78c3
Add HttpServletResponse param to removeAuthorizationRequest
...
Fixes gh-5313
2018-07-26 14:15:56 -04:00
887db71333
Fix typo ( #5580 )
2018-07-26 10:04:21 -04:00
ba29b363fc
Fix OAuth2AuthorizationRequestRedirectWebFilter baseurl exclude querystring
...
To create redirect_uri in OAuth2AuthorizationRequestRedirectWebFilter,
queryParam is included in the current request-based baseUrl.
So when binding to the redirectUriTemplate,
the wrong type of redirect_uri may be created.
Fixed: gh-5520
2018-07-23 15:42:15 -04:00
36cbdfe013
Fix NPE when null Authentication in authorization_code grant
...
Fixes gh-5560
2018-07-23 12:28:48 -04:00
88975dad41
ServletOAuth2AuthorizedClientExchangeFilterFunction handles null authorized client
...
Issue: gh-5545
2018-07-22 12:01:42 -07:00
67dd3f16e9
Add static methods for ServletOAuth2AuthorizedClientExchangeFilterFunction
...
This will allow us to break up
ServletOAuth2AuthorizedClientExchangeFilterFunction into multiple
components if we decide to later.
Issue: gh-5545
2018-07-20 11:48:20 -05:00
9ababf4168
Rename to ServerOAuth2AuthorizedClientExchangeFilterFunction
...
Rename OAuth2AuthorizedClientExchangeFilterFunction to
ServerOAuth2AuthorizedClientExchangeFilterFunction->
Issue: gh-5386
2018-07-20 11:48:19 -05:00
1b79bbed7f
Add ServletOAuth2AuthorizedClientExchangeFilterFunction
...
Fixes: gh-5545
2018-07-20 11:48:19 -05:00
3c461b704c
Add AuthenticationMethod type
...
This section defines three methods of sending bearer access tokens
in resource requests to resource servers.
Clients MUST NOT use more than
one method to transmit the token in each request.
RFC6750 Section 2 Authenticated Requests
https://tools.ietf.org/html/rfc6750#section-2
Add AuthenticationMethod in ClientRegistration UserInfoEndpoint.
Add AuthenticationMethod for OAuth2UserService to get User.
To support the use of the POST method.
https://tools.ietf.org/html/rfc6750#section-2.2
gh-5500
2018-07-20 11:32:51 -04:00
9a144d742e
Use OAuth2AuthorizedClientRepository in filters and resolver
...
Fixes gh-5544
2018-07-19 22:57:10 -04:00
3f8e69211f
Fix OAuth2 ClientRegistration scope can be null
...
Allows scope of OAuth2 ClientRegistration to be null.
- The scope setting in the RFC document is defined as Optional.
https://tools.ietf.org/html/rfc6749#section-4.1.1
> scope: OPTIONAL.
> The scope of the access request as described by Section 3.3.
- When the client omits the scope parameter,
validation is determined by the authorization server.
https://tools.ietf.org/html/rfc6749#section-3.3
> If the client omits the scope parameter when requesting
authorization, the authorization server MUST either process the
request using a pre-defined default value or fail the request
indicating an invalid scope. The authorization server SHOULD
document its scope requirements and default value (if defined).
Fixes gh-5494
2018-07-18 16:17:14 -04:00
191a4760f9
Fix DefaultOAuth2AuthorizationRequestResolver baseUrl excludes queryParams
...
To create redirect_uri in DefaultOAuth2AuthorizationRequestResolver,
queryParam is included in the current request-based baseUrl.
So when binding to the redirectUriTemplate,
the wrong type of redirect_uri may be created.
Fixes gh-5520
2018-07-17 12:00:01 -04:00
981d35a92c
Add ClientRegistration.Builder.registrationId
...
Fixes: gh-5527
2018-07-17 01:27:39 -05:00
becff23df1
Reliable Error State Tests - Nimbus
...
A test against the Nimbus library was relying on specific messaging
from Nimbus as well as the JDK, making it brittle.
Now, it simply relies on the messaging that we control.
Issue: gh-4887
2018-07-16 14:46:42 -06:00
d595098823
Rename @TransientAuthentication to @Transient
...
It is quite likely we will need to prevent certain Exceptions from being
saved or from triggering a saved request. When we add support for this,
we can now leverage @Transient vs creating a new annotation.
Issue: gh-5481
2018-07-16 11:31:10 -05:00
40ccdb93f7
Resource Server Jwt Support
...
Introducing initial support for Jwt-Encoded Bearer Token authorization
with remote JWK set signature verification.
High-level features include:
- Accepting bearer tokens as headers and form or query parameters
- Verifying signatures from a remote Jwk set
And:
- A DSL for easy configuration
- A sample to demonstrate usage
Fixes: gh-5128
Fixes: gh-5125
Fixes: gh-5121
Fixes: gh-5130
Fixes: gh-5226
Fixes: gh-5237
2018-07-16 10:40:46 -05:00
6e67c0dcea
Remap Nimbus JSON Parsing Errors
...
When Nimbus fails to parse either a JWK response or a JWT response,
the error message contains information that either should or cannot be
included in a Bearer Token response.
For example, if the response from a JWK endpoint is invalid JSON, then
Nimbus will send the entire response from the authentication server in
the resulting exception message.
This commit captures these exceptions and removes the parsing detail,
replacing it with more generic information about the nature of the
error.
Fixes: gh-5517
2018-07-16 10:40:46 -05:00
371221d729
Support anonymous Principal for OAuth2AuthorizedClient
...
Fixes gh-5064
2018-07-16 10:15:41 -05:00
779597af2a
Add support for custom authorization request parameters
...
Fixes gh-4911
2018-07-16 09:39:06 -05:00
1d920680bf
Enhance OAuth2AccessToken to be serializable
...
Change the TokenType to Serializable
so that the OAuth2AccessToken can be serialized.
(org.springframework.security.oauth2.core.OAuth2AccessToken.TokenType)
Fixes gh-5492
2018-07-13 11:36:11 -04:00
a5ae714ed5
NimbusReactiveJwtDecoder propagates errors looking up keys
...
Fixes: gh-5490
2018-07-06 16:39:59 -05:00
998d1a064b
Close Nimbus Information Leak
...
This commit captures and remaps the exception that Nimbus throws
when a PlainJWT is presented to it.
While the surrounding classes are likely only used today by the
oauth2Login flow, since they are public, we'll patch them at this
point for anyone who may be using them directly.
Fixes: gh-5457
2018-07-03 10:28:31 -05:00
f7dc76de5f
Fix OAuth2BodyExtractorsTests for JDK9
...
Issue: gh-5475
2018-07-02 16:29:07 -05:00
ba489af354
Fix OAuth2AuthorizedClientExchangeFilterFunctionTests on JDK9
...
Issue: gh-4371
2018-07-02 16:16:16 -05:00
127a32bd81
Fix checkstyle OAuth2AuthorizedClientExchangeFilterFunctionTests
...
Issue: gh-4371
2018-07-02 15:47:24 -05:00
73689ecfd7
Fix Imports of OAuth2AccessTokenResponse
...
Issue: gh-5474
2018-07-02 15:46:33 -05:00
0116c65c0e
OAuth2AuthorizedClientExchangeFilterFunction Refresh Support
2018-07-02 14:14:17 -05:00
1f1fb1a801
Add MockExchangeFunction getResponse
...
This allows setting up the mock
Issue: gh-5386
2018-07-02 12:43:00 -05:00
0910e04bdf
MockExchangeFunction Support Multiple Requests
...
Issue: gh-5386
2018-07-02 12:42:54 -05:00
e27e1cd637
Add OAuth2AccessTokenResponseBodyExtractor
...
This externalizes converting a OAuth2AccessTokenResponse from a
ReactiveHttpInputMessage.
Fixes: gh-5475
2018-07-02 12:41:44 -05:00
ab61732e17
Add OAuth2AccessTokenResponse.withResponse
...
Add ability to build a new OAuth2AccessTokenResponse from another
OAuth2AccessTokenResponse.
Fixes: gh-5474
2018-07-02 12:37:45 -05:00
d7ebe5be86
Rename createJwkSet method typo
...
Actually, it is creating a claims set, just a typo.
Issue: gh-5330
2018-06-28 11:31:21 -06:00
8ef4a5ba92
Add NimbusReactiveJwtDecoder RSAPublicKey Support
...
Fixes: gh-5460
2018-06-25 21:30:49 -05:00
d32aa3c6d6
Validate sub claim in UserInfo Response
...
Fixes gh-5447
2018-06-25 16:44:04 -04:00
81350ca3c3
Add NimbusJwkReactiveJwtDecoderTests
...
Issue: gh-5330
2018-06-25 12:13:08 -05:00
7b406e89e4
Fixes in decoder
2018-06-25 10:08:13 -05:00
a5f7713d9f
adding a test
2018-06-25 10:03:53 -05:00
d521d5e066
Add OidcReactiveAuthenticationManager
...
Fixes: gh-5330
2018-06-18 16:08:07 -05:00
f7a2a41241
Add OidcReactiveOAuth2UserService
...
Issue: gh-5330
2018-06-18 16:08:07 -05:00
5ed319b11a
Add NimbusReactiveJwtDecoder
...
Issue: gh-5330
2018-06-18 16:08:07 -05:00
0d23aad911
Add ReactiveRemoteJWKSource
...
Issue: gh-5330
2018-06-18 16:08:07 -05:00
7898ce2ded
Add JWKContextJWKSource
...
Issue: gh-5330
2018-06-18 16:08:07 -05:00
aa0ea4a8eb
Add JWKContext
...
Issue: gh-5330
2018-06-18 16:06:32 -05:00
923e23d05b
Add JWKSelectorFactory
...
Issue: gh-5330
2018-06-18 16:06:26 -05:00
3ddde473f2
Extract OidcTokenValidator
...
Issue: gh-5330
2018-06-18 16:06:19 -05:00
adb8c60173
Extract OidcUserRequestUtils
...
This logic is shared by both reactive and non-reactive clients.
Issue: gh-5330
2018-06-18 16:06:01 -05:00
a3db6fc993
Polish OidcUserService
...
Fixes: gh-5449
2018-06-18 16:03:41 -05:00
02d29887fb
Associate Refresh Token to OAuth2AuthorizedClient
...
Fixes gh-5416
2018-06-12 11:31:43 -04:00
4fc6d96073
Rename @OAuth2Client to @RegisteredOAuth2AuthorizedClient
...
Fixes gh-5360
2018-06-08 17:33:21 -04:00
dd1b1b9cc3
Use Spring Framework 5.1.0 SNAPSHOT
...
Fixes: gh-5408
2018-06-05 12:28:51 -05:00
fe979aa996
OidcUserService leverages DefaultOAuth2UserService
...
Fixes gh-5390
2018-05-31 16:17:47 -04:00
82e4abdd32
OAuth2ClientArgumentResolver uses AnnotatedElementUtils
...
Fixes gh-5335
2018-05-29 21:29:33 -04:00
32c33d1def
Add OAuth2AuthenticationException constructor that takes only OAuth2Error
...
Fixes gh-5374
2018-05-29 21:10:34 -04:00
b3ca598679
Add WebClient Bearer token support
...
Fixes: gh-5389
2018-05-25 15:17:08 -05:00
c68cf991ae
Add OAuth2AuthorizedClientExchangeFilterFunction
...
Fixes: gh-5386
2018-05-25 11:01:55 -05:00
2658577396
OAuth2AuthorizationRequestRedirectWebFilter handles ClientAuthorizationRequiredException
...
Fixes: gh-5383
2018-05-24 16:40:41 -05:00
0eedfc717a
Revert "Revert "Add ClientRegistration from OpenID Connect Discovery""
...
This reverts commit 9fe0f50e3c
2018-05-18 09:40:43 -05:00
9fe0f50e3c
Revert "Add ClientRegistration from OpenID Connect Discovery"
...
This reverts commit 0598d47732
2018-05-18 09:20:51 -05:00
0598d47732
Add ClientRegistration from OpenID Connect Discovery
...
Fixes: gh-4413
2018-05-16 12:30:04 -05:00
7013c6fd76
Add OAuth2LoginSpec
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
23f4b9d3d1
Add OAuth2AuthorizationRequestRedirectWebFilter
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
de959dbff6
Add OAuth2ClientArgumentResolver
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
c1e9785a48
Add OAuth2LoginReactiveAuthenticationManager
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
7401cb2b51
Add ServerOAuth2LoginAuthenticationTokenConverter
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
3cd2ddf793
Add NimbusReactiveAuthorizationCodeTokenResponseClient
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
3220e9560a
Add DefaultReactiveOAuth2UserService
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
b613b2d253
Add WebSessionOAuth2ReactiveAuthorizationRequestRepository
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
5e9c714ff0
Add InMemoryReactiveOAuth2AuthorizedClientService
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
a02b0c17f8
Add InMemoryReactiveClientRegistrationRepository
...
Issue: gh-4807
2018-05-11 04:19:50 -05:00
c696640276
OAuth2AuthorizationResponseUtils uses MultiMap
...
Fixes: gh-5331
2018-05-11 04:19:50 -05:00
fff64db0e2
Improve ClaimAccessor getClaimAsInstant
...
Fixes gh-5250
2018-05-03 21:03:45 -04:00
2356749cc3
Add test NimbusUserInfoResponseClient sets Accept header to JSON
...
Issue gh-5294
2018-05-03 20:18:41 -04:00
b8f225c49e
NimbusUserInfoResponseClient sets Accept header to JSON
...
Fixes gh-5294
2018-05-03 16:34:38 -04:00
4cc5705ae5
HttpSessionOAuth2AuthorizationRequestRepository removes empty Map from session
...
Fixes gh-5263
2018-05-02 11:07:26 -04:00
49b63e260d
OAuth2LoginAuthenticationFilter should handle null ClientRegistration
...
Fixes gh-5251
2018-05-02 09:16:42 -04:00
6095340e93
OAuth2AuthorizationRequestRedirectFilter -> Reuse code for baseUrl
...
Fixes gh-5153
2018-04-09 21:11:00 -04:00
d8f91e4261
Fix NPE with exp claim in NimbusJwtDecoderJwkSupport
...
Fixes gh-5168
2018-04-04 07:58:32 -04:00
2bd31c96ed
ClaimAccessor.getClaimAsInstant() converts Long or Date
...
Fixes gh-5191, Fixes gh-5192
2018-04-03 21:14:25 -04:00
526e0fdd4f
Add OAuth2 Client HandlerMethodArgumentResolver
...
Fixes gh-4651
2018-04-02 12:13:52 -04:00
982fc360b2
Add support for authorization_code grant
...
Fixes gh-4928
2018-04-02 12:13:06 -04:00
ce2f669245
Remove state assertion when loading OAuth2AuthorizationRequest
...
Fixes gh-5163
2018-03-27 20:06:30 -04:00
d07cfe655d
Use Supplier variants of Assert methods
2018-03-27 10:58:55 -05:00
bb15213091
Ensure consistency by using Collection<GrantedAuthority> type
...
Fixes gh-5143
2018-03-21 10:35:18 -04:00
90f9d728cd
Allow extension for OAuth2Error
...
Fixes gh-5148
2018-03-21 10:04:57 -04:00
bf41d48718
HttpSessionOAuth2AuthorizationRequestRepository support distributed HttpSession
...
Previously HttpSessionOAuth2AuthorizationRequestRepository
getAuthorizationRequest attempted to update the state of HttpSession as
well as getting the Map of OAuth2AuthorizationRequest. This had a few
problems
- First it was confusing that a get method updated state
- It worked when the session was in memory, but would not work when the
HttpSesson was persisted to an external store (i.e. Spring Session) since
after updating the Map, there was no invocation to update
This commit cleans up the logic and ensures that the values are explicitly
set in the HttpSession so it works with a session persisted in an external
store.
Fixes: gh-5146
2018-03-20 22:14:48 -05:00
04e2e86e6e
Polish HttpSessionOAuth2AuthorizationRequestRepositoryTests
...
Fixes: gh-5147
2018-03-20 22:14:48 -05:00
59cef7d339
HttpSessionOAuth2AuthorizationRequestRepository handle multiple OAuth2AuthorizationRequest per session
...
Fixes gh-5110
2018-03-20 22:14:48 -05:00
a5bd76b6ed
Revert authorization_code grant support
...
This reverts commit eae7afd9aa
2018-03-06 16:16:45 -05:00
eae7afd9aa
Add support for authorization_code grant
...
Fixes gh-4928
2018-03-02 14:30:49 -05:00
7eb58ee7d9
DefaultOAuth2UserService -> assert UserInfo Uri is set
...
Fixes gh-4992
2018-02-02 13:01:18 -05:00
6b24aaf6f5
Add javadoc for spring-security-oauth2-jose
...
Fixes gh-4885
2018-01-23 21:27:47 -05:00
fe2ac00deb
Add javadoc for spring-security-oauth2-client
...
Fixes gh-4884
2018-01-23 17:07:21 -05:00
e6cac604f3
Add javadoc for spring-security-oauth2-core
...
Fixes gh-4883
2018-01-18 16:00:26 -05:00
1d32fffc1d
Make OAuth2Error Serializable
...
Fixes gh-4944
2018-01-10 10:40:54 -05:00
57353d18e5
Use diamond type
2017-12-21 15:09:00 -06:00
c16456623f
Remove unused imports
2017-12-20 16:05:38 -06:00
268a1dc06e
DefaultOAuth2User is Serializable
...
Fixes gh-4917
2017-12-19 09:07:17 -05:00
ae664c33b1
Polish
...
Fix compile warnings in ClientRegistrationTests
2017-11-27 12:12:59 -06:00
edccafca84
Create OAuth2AuthorizationResponse lazily
...
This commit creates `OAuth2AuthorizationResponse` as lazily as possible to prevent the creation when `authorizationRequest` is `null`.
Fixes gh-4848
2017-11-20 11:01:34 -05:00
c04b3b4114
Exclude well-known ports in expanded redirect-uri
...
Fixes gh-4836
2017-11-18 10:41:27 -05:00
b6895e6359
Apply Checkstyle WhitespaceAfterCheck module
2017-11-16 11:18:31 -06:00
dd33f0a7de
ClientRegistration.redirectUri -> redirectUriTemplate
...
Fixes gh-4827
2017-11-15 14:51:35 -05:00
e098c3707e
Update default redirect-uri to use 'baseUrl' template variable
...
Fixes gh-4826
2017-11-15 14:51:35 -05:00
d900f2a623
Remove unused imports
...
This commit also adds UnusedImportsCheck Checkstyle module.
2017-11-14 14:41:08 -06:00
872a8f3189
Change constructor param order in oauth2 client filters
...
Fixes gh-4818
2017-11-13 17:32:22 -05:00
426c034c01
OidcUserService uses custom userNameAttributeName
...
Fixes gh-4812
2017-11-12 14:44:57 -05:00
6775d9fdd8
OAuth2AccessTokenResponse should account for expires_in <= 0
...
Fixes gh-4810
2017-11-12 11:30:11 -05:00
63e2db72ea
Add tests to oauth2-jose
...
Fixes gh-4806
2017-11-10 17:09:48 -05:00
473ac0e37c
Add tests to oauth2-client
...
Fixes gh-4299
2017-11-10 16:03:34 -05:00
db35dc6c03
Add tests to oauth2-core
...
Fixes gh-4298
2017-11-06 11:39:17 -05:00
ef9cd76607
Polish oauth2
...
Fixes gh-4758
2017-10-30 16:49:01 -04:00
d435f149eb
Polish spring-security-oauth2-jose
...
Fixes gh-4755
2017-10-30 13:09:40 -04:00
511d702ee0
Remove JwtDecoderRegistry
...
Fixes gh-4754
2017-10-30 12:52:42 -04:00
d9584384c4
Move collectClaims to OidcUserAuthority
...
Fixes gh-4749
2017-10-29 20:41:05 -05:00
3d065b5afd
Add getIdToken getUser to OidcUser
...
Fixes gh-4748
2017-10-29 20:10:55 -05:00
c1c726f123
Polish InMemoryClientRegistrationRepository
...
Issue: gh-4745
2017-10-29 20:03:36 -05:00
a3e38fec47
Remove AuthorizationRequestUriBuilder
...
Make this API private since we don't have concrete use cases for exposing
it yet.
Fixes gh-4742
2017-10-29 19:50:02 -05:00
c3d2effc1d
Polish OAuth2AuthorizedClientService
...
Fixes gh-4746
2017-10-29 20:25:03 -04:00
b496ad4d86
Polish OAuth2LoginAuthenticationToken
...
Fixes gh-4744
2017-10-29 19:21:41 -04:00
8032baa296
Polish InMemoryClientRegistrationRepository
...
- use Map.get
- Construct with stream()
- Add tests
- Remove unnecessary unmodifiableCollection (already unmodifiable)
Fixes gh-4745
2017-10-29 18:07:49 -05:00
f0c2944377
OAuth2AuthorizationResponse getAccessToken
...
No longer delegate to OAuth2AccessToken but add getAccessToken()
Fixes gh-4743
2017-10-29 17:12:46 -05:00
e4887057bc
Rename AuthorizationGrantTokenExchanger -> OAuth2AccessTokenResponseClient
...
Fixes gh-4741
2017-10-29 17:49:15 -04:00
2a00232a5b
Remove UserInfoRetreiver
...
Fixes gh-4740
2017-10-29 17:49:15 -04:00
6fbd435bdf
OAuth2LoginAuthenticationFilter requires collaborators
...
Fixes gh-4661
2017-10-29 04:41:23 -04:00
b471dd1c54
Remove OAuth2TokenRepository
...
Fixes gh-4727
2017-10-28 21:40:33 -04:00
b1d56b5821
NimbusAuthorizationCodeTokenExchanger uses authorizationRequest.redirectUri
...
Fixes gh-4701
2017-10-28 21:30:40 -04:00
006319f19a
UserInfoRetriever supports ParameterizedTypeReference
...
Fixes gh-4693
2017-10-28 19:26:04 -04:00
9dc4aa6c81
Make OidcUserInfo Serializable
...
Fixes gh-4733
2017-10-28 18:35:21 -04:00
83dc902ff7
Map CustomUserTypesOAuth2UserService using clientRegistrationId
...
Fixes gh-4692
2017-10-28 18:11:39 -04:00
0c68eb1821
Re-factor OAuth2AuthorizationCodeAuthenticationToken
...
Fixes gh-4730
2017-10-28 17:15:31 -04:00
64d8c8b8a9
Re-factor AuthorizationGrantTokenExchanger
...
Fixes gh-4728
2017-10-28 17:12:14 -04:00
16e69d06b4
Add OAuth2AuthorizedClientService
...
Fixes gh-4726
2017-10-28 17:12:14 -04:00
f0b0cfc4fd
Ensure Copyright header reads 2002-2017
...
fixes gh-4655
Signed-off-by: Sola <dev@sola.love>
2017-10-28 13:02:06 -05:00
67bac28481
OAuth2UserService uses OAuth2UserRequest
...
Fixes gh-4724
2017-10-27 22:34:25 -04:00
3d319f7592
Make AuthorizationRequestRepository a Generic
...
Fixes gh-4723
2017-10-27 21:31:45 -04:00
9afefef3b9
Polish class names in oauth2-client
...
Fixes gh-4722
2017-10-27 21:00:52 -04:00
34668e05af
Polish class names in oauth2-core
...
Fixes gh-4720
2017-10-27 20:42:58 -04:00
8527daa22a
Make OAuth2UserService Generic using OAuth2AuthorizedClient and OAuth2User types
...
Fixes gh-4706
2017-10-27 11:49:29 -04:00
3b80b6ded8
Move AuthorizationRequestUriBuilder to oauth2-client
...
Fixes gh-4703
2017-10-26 21:23:06 -04:00
ef197d8215
Move JwtDecoderRegistry to oauth2.client.jwt package
...
Fixes gh-4705
2017-10-26 21:06:28 -04:00
70543dcb30
Move oidc package in oauth2-core and oauth2-client
...
Fixes gh-4710
2017-10-26 21:06:28 -04:00
c5da9e08fd
Move AuthorizedClient to root package oauth2.client
...
Fixes gh-4709
2017-10-26 15:51:26 -04:00
ef83bc8dd7
Move package client.authentication.userinfo -> client.userinfo
...
Fixes gh-4708
2017-10-26 15:39:04 -04:00
35fb96a2f8
Move OAuth2AuthenticationException to oauth2-core
...
Fixes gh-4707
2017-10-26 15:12:03 -04:00
027ea78dab
Revert "Move OAuth2LoginAuthenticationProvider into userinfo package"
...
This reverts commit 54547f35b7
2017-10-26 14:55:25 -04:00
942b647c0d
OAuth2LoginAuthenticationFilter processes uri /login/oauth2/code/*
...
Issue gh-4687
2017-10-26 14:20:19 -04:00
54547f35b7
Move OAuth2LoginAuthenticationProvider into userinfo package
...
Fix package tangles. OAuth2LoginAuthenticationProvider requires
OAuth2UserService which is in a child package. We should move
OAuth2LoginAuthenticationProvider to the same package.
Issue: gh-4614
2017-10-26 11:22:21 -05:00
18dd49b47c
Validate ID Token
...
Fixes gh-4440
2017-10-26 11:36:44 -04:00
d0a4e49870
Map custom OAuth2User types using String
...
Fixes gh-4691
2017-10-25 17:13:44 -04:00
1a3b9c1f3f
Polish UserInfoRetriever
...
Issue gh-4695
2017-10-25 16:48:50 -04:00
43d201fa3e
Move OAuth2AuthenticationToken
...
Fixes gh-4697
2017-10-25 16:17:49 -04:00
9fbea5a11e
Refactor SecurityTokenRepository
...
Fixes gh-4650
2017-10-25 16:00:34 -04:00
5237c6e01b
Remove AuthorizedClient.getAuthorizedScopes()
...
Fixes gh-4696
2017-10-25 14:06:34 -04:00
5a584e5ccb
Rename OAuth2/OIDC ClientAuthenticationToken -> AuthorizedClient
...
Fixes gh-4695
2017-10-25 13:47:00 -04:00
9b670882b7
Rename SecurityToken -> AbstractOAuth2Token
...
Fixes gh-4646
2017-10-25 10:29:34 -04:00
1bd826897f
UserInfoRetriever.retrieve accepts the type to convert
...
Fixes gh-4688
2017-10-24 15:14:58 -05:00
4dbbcabacf
Rename AuthorizationCodeAuthenticationProvider -> OAuth2LoginAuthenticationProvider
...
Fixes gh-4690
2017-10-24 15:24:26 -04:00
049080290e
Refactor OAuth2 AuthenticationProvider's
...
Fixes gh-4689
2017-10-24 15:24:26 -04:00
0fb32a052e
OAuth2LoginAuthenticationFilter processes uri /login/oauth2/*
...
Fixes gh-4687
2017-10-24 15:24:26 -04:00
4ae24f2fbe
Rename AuthorizationCodeAuthenticationFilter -> OAuth2LoginAuthenticationFilter
...
Fixes gh-4686
2017-10-24 15:24:25 -04:00
8e7838fa64
Verify UserInfo Response sub claim
...
Fixes gh-4441
2017-10-23 11:44:29 -04:00
ff0009daed
Add AuthorizationRequest.Builder.scope(String...)
...
Fixes gh-4643
2017-10-23 11:20:15 -04:00
8a416793aa
Return AuthorizationRequest from AuthorizationRequestRepository.removeAuthorizationRequest
...
Fixes gh-4652
2017-10-23 11:02:17 -04:00
6d7d34c549
Move AuthorizationRequestUriBuilder and DefaultAuthorizationRequestUriBuilder
...
Fixes gh-4658
2017-10-23 10:19:31 -04:00
f0c9f85292
spring-security-jwt-jose -> spring-security-oauth2-jose
...
Fixes gh-4595
2017-10-23 09:04:01 -04:00
c94b3f4d23
Add AuthorizationExchange
...
Fixes gh-4660
2017-10-20 20:59:32 -04:00
eb2b573426
Validate Authorization Response
...
Fixes gh-4657, Issue gh-4654
2017-10-20 20:59:32 -04:00
8e3a2a7123
Remove AuthorizationCodeAuthenticationFilter.AuthorizationResponseMatcher
...
Fixes gh-4654
2017-10-20 06:09:31 -04:00
84a1c417a3
Extract Converter from AuthorizationResponseMatcher
...
Fixes gh-4653
2017-10-20 04:56:07 -04:00
d4dac21ca5
Make ClientRegistration.Builder constructor private
...
Fixes gh-4656
2017-10-19 14:15:59 -04:00
a980e3b0d7
Remove ClientRegistrationIdentifierStrategy
...
Fixes gh-4648
2017-10-19 13:40:06 -04:00
f3756cdd07
Remove ClientRegistrationProperties
...
Fixes gh-4649
2017-10-19 13:27:54 -04:00
1f5edc98d5
ClientRegistration.Builder.scopes -> scope
...
Fixes gh-4663
2017-10-19 11:24:01 -04:00
1e891b38ab
Rename scope -> scopes for Set types
...
Fixes gh-4644
2017-10-18 17:56:39 -04:00
a77bdb0c5d
Make AuthorizationRequest serializable
...
Fixes gh-4627
2017-10-18 15:55:37 -04:00
d7d6400971
DefaultStateGenerator->Base64StringKeyGenerator
...
Rename and move DefaultStateGenerator since it is more generic than just
OAuth.
Fixes gh-4645
2017-10-18 11:29:04 -05:00
d554b06a43
OAuth use ConcurrentHashMap
...
Fixes gh-4647
2017-10-17 22:17:09 -05:00
b764c666c6
Fix jwt package tangles
...
JWT is part of OAuth2, so it should be a subpackage of oauth2.
Fixes gh-4614
2017-10-17 21:06:27 -05:00
c5abcd1fcd
DefaultAuthorizationRequestUriBuilder uses StringUtils
...
Fixes gh-4642
2017-10-17 20:24:43 -05:00
7b8d131386
Fix package tangles -> OAuth2/Oidc AuthenticationProvider's
...
Fixes gh-4614
2017-10-16 20:56:32 -04:00
25052214ae
Polish
2017-10-16 18:33:27 -05:00
a7d054c9f3
Remove AuthorizationGrantAuthenticator
2017-10-16 13:43:11 -04:00
3c824dc44b
Fix package tangles -> OAuth2UserService
...
Fixes gh-4614
2017-10-13 18:59:41 -04:00
cfa4858b04
Fix package tangles -> AuthorizationGrantTokenExchanger
...
Fixes gh-4614
2017-10-13 16:35:48 -04:00
Joe Grandja
Rob Winch
Josh Cummings
Eric Deandrea
Johnny Lim
mhyeon.lee
Christoph Dreis
Eddú Meléndez
Sola