5f26daedcb
Error On Unsupported Client Authentication Methods
...
Closes gh-13144
2023-06-12 15:13:13 -06:00
f843232d84
Merge branch '6.0.x'
...
Closes gh-13223
2023-05-24 15:32:12 -06:00
69b17f3d3f
Merge branch '5.8.x' into 6.0.x
...
Closes gh-13222
2023-05-24 15:29:39 -06:00
c1002ff745
Improve Error Handling
...
Closes gh-13143
2023-05-24 15:29:15 -06:00
76eba9bd0c
Add withIssuerLocation
...
Closes gh-10309
2023-04-12 16:36:15 -06:00
9ee8202625
Merge branch '6.0.x'
...
Closes gh-13006
2023-04-12 12:50:19 -06:00
b423db5f93
Merge branch '5.8.x' into 6.0.x
...
Closes gh-13005
2023-04-12 12:46:11 -06:00
28be37238d
Merge branch '5.7.x' into 5.8.x
...
Closes gh-13004
2023-04-12 12:45:28 -06:00
c4e9fb885d
Delay JWSVerificationKeySelector Construction
...
Updating the NimbusReactiveJwtDecoder.JwkSetUriReactiveJwtDecoderBuilder processor to execute the ConfigurableJWTProcessor customizations before holding a reference to the JWSKeySelector.
Closes gh-12960
2023-04-12 12:45:00 -06:00
6f8ec3df60
Ensure access token isn't resolved from query for form-encoded requests
...
Closes gh-5668
2023-04-10 17:06:47 -06:00
64a1ad5cd6
Merge branch '5.8.x' into 6.0.x
2023-04-04 13:32:34 -06:00
5ffebaf12b
Merge branch '5.7.x' into 5.8.x
2023-04-04 13:32:04 -06:00
39cee36065
Use SingletonSupplier
...
Issue gh-9991
2023-04-04 13:25:31 -06:00
88540aa52f
Use SingletonSupplier
...
Issue gh-9991
2023-04-04 13:23:03 -06:00
f0ef54050e
Add ability to set principalClaimName in ReactiveJwtAuthenticationConverter
...
Closes #12907
2023-03-27 16:43:30 -06:00
55224b58e0
Polish gh-12853
2023-03-20 15:47:00 -04:00
a7562ad950
Update io.spring.javaformat to 0.0.38
...
Closes gh-12891
2023-03-20 10:44:35 -06:00
8c17b978c8
Add support for device authorization response
...
Closes gh-12852
2023-03-08 17:07:56 -06:00
613b16c247
NimbusReactiveJwtDecoder support mono chain
...
Supports reactive exception handling when using PublicKeyReactiveJwtDecoderBuilder and SecretKeyReactiveJwtDecoderBuilder
2023-02-07 13:37:23 -07:00
b237d7ee38
Merge branch '6.0.x'
...
Closes gh-12621
2023-02-03 12:31:08 -03:00
7409d14504
fix javax.json.bind.Jsonb to jakarta.json.bind.Jsonb
...
Closes gh-12616
2023-02-03 12:30:17 -03:00
e7fb6d2e14
Merge branch '6.0.x'
...
Closes gh-12496
2023-01-06 12:56:45 -07:00
748e912685
Merge branch '5.8.x' into 6.0.x
...
Closes gh-12495
2023-01-06 12:56:21 -07:00
5e1db6a771
Merge branch '5.7.x' into 5.8.x
...
Closes gh-12494
2023-01-06 12:55:43 -07:00
225dc593a8
Polish NimbusJwtDecoderTests
...
- Add missing mock
Closes gh-12238
2023-01-06 12:53:36 -07:00
e0e9455f78
Merge branch '6.0.x'
...
Closes gh-12441
2022-12-19 16:01:26 -07:00
7bd6deccc3
Revert "Disable Some R2dbc Tests"
...
This reverts commit 813179931a
2022-12-19 15:42:22 -07:00
7ad4ebd07a
Allow authentication details to be set by converter
...
Prevent JwtAuthenticationProvider from setting authentication details
when jwtAuthenticationConverter returned an authentication instance
with non null details.
Closes gh-11822
2022-12-12 18:55:08 -06:00
7561a02cdd
Merge branch '6.0.x'
2022-12-05 11:13:43 -07:00
813179931a
Disable Some R2dbc Tests
...
Issue gh-12339
2022-12-05 11:13:15 -07:00
cd0f02de49
Polish authorities claim delimiter
...
PR gh-12074
2022-12-02 14:30:31 -07:00
9c9fd9f4bd
Add configurable authorities split regex
...
Before this commit splitting the authorities claim was done by a
hardcoded regex " ". This commit allows to configure to set any regex
to split the authorities claim while keeping the previously
hardcoded regex as a default.
Closes gh-12074
2022-12-02 14:30:30 -07:00
b22bc42bb0
Merge branch '5.8.x' into 6.0.x
...
Closes gh-12325
2022-11-30 14:50:51 -07:00
29c00905ce
Merge branch '5.7.x' into 5.8.x
...
Closes gh-12324
2022-11-30 14:49:26 -07:00
667cab6cda
Merge branch '5.6.x' into 5.7.x
...
Closes gh-12323
2022-11-30 14:38:16 -07:00
52c7141aac
Save Request Before Response Is Committed
...
Specifically important for cookie-based authorization request
repositories.
Closes gh-11602
2022-11-30 14:33:08 -07:00
bb3d92e33a
Update r2dbc-h2 to 1.0.0.RELEASE
...
Closes gh-12251
2022-11-18 23:04:38 -06:00
4e88623873
Polish gh-12087 in 6.0
2022-11-17 14:31:44 -06:00
a3d35ecf3c
Merge branch '5.8.x'
...
Closes gh-12234
2022-11-17 14:27:41 -06:00
52888d6206
Warn when AuthorizationGrantType does not match
...
Log a warning when AuthorizationGrantType does not exactly match a
pre-defined constant.
Closes gh-11905
2022-11-17 14:17:54 -06:00
ce065a87da
Merge branch '5.8.x'
...
Closes gh-12207
2022-11-14 12:25:05 -06:00
71eb71d185
Merge branch '5.7.x' into 5.8.x
...
Closes gh-12206
2022-11-14 12:11:59 -06:00
67a1f0836b
Merge branch '5.6.x' into 5.7.x
...
Closes gh-12205
2022-11-14 12:10:55 -06:00
fde26e003a
Request user info when AS returns no scopes
...
Closes gh-12144
2022-11-10 16:29:43 -06:00
5fe59cc635
Revert "Add configurable authorities split regex"
...
This reverts commit e93ed6d94c
2022-11-01 17:39:26 -06:00
e93ed6d94c
Add configurable authorities split regex
...
Before this commit splitting the authorities claim was done by a
hardcoded regex " ". This commit allows to configure to set any regex
to split the authorities claim while keeping the previously
hardcoded regex as a default.
2022-11-01 17:38:47 -06:00
cca999c57d
Merge remote-tracking branch 'origin/5.8.x'
2022-11-01 13:46:08 -06:00
d29ab8bcae
Merge branch '5.7.x' into 5.8.x
2022-11-01 13:43:40 -06:00
c94e33b6c8
Merge branch '5.6.x' into 5.7.x
2022-11-01 13:42:35 -06:00
8315545144
Update RP-Initiated Logout target URLs.
...
The URLs we're using are not actually pointing to the OIDC RP-Initiated Logout Specs.
Fixes: gh-12081
2022-11-01 12:35:39 -06:00
801ceb0832
Merge branch '5.8.x'
2022-10-31 08:58:14 -05:00
66f2f1cde7
Merge branch '5.7.x' into 5.8.x
2022-10-31 08:55:03 -05:00
2915a70bf7
Merge branch '5.6.x' into 5.7.x
2022-10-28 13:05:48 -05:00
26a51ee198
Merge branch '5.5.x' into 5.6.x
2022-10-28 11:15:33 -05:00
e7fe778abc
Merge branch '5.4.x' into 5.5.x
2022-10-28 11:13:33 -05:00
3e2ac82612
Merge branch '5.3.x' into 5.4.x
2022-10-28 11:10:39 -05:00
5560bbaa80
Merge branch '5.2.x' into 5.3.x
2022-10-28 11:07:51 -05:00
75004587a4
Fix scope mapping
...
Issue gh-12101
2022-10-28 11:00:27 -05:00
f4cc27c375
Change Default for (Server)AuthenticationEntryPointFailureHandler
...
Closes gh-9429
2022-10-13 20:03:03 -06:00
5afc7cb04f
Merge remote-tracking branch 'origin/5.8.x'
2022-10-13 19:48:05 -06:00
099aaa33ff
Remove Deprecation Markers
...
Since Spring Security still needs these methods and classes, we
should wait on deprecating them if we can.
Instead, this commit changes the original classes to have a
boolean property that is currently false, but will switch to true
in 6.0.
At that time, BearerTokenAuthenticationFilter can change to use
the handler.
Closes gh-11932
2022-10-13 19:47:22 -06:00
200b7fecd3
Add (Server)AuthenticationEntryPointFailureHandlerAdapter
...
Issue gh-11932, gh-9429
(Server)AuthenticationEntryPointFailureHandler should produce HTTP 500 instead
when an AuthenticationServiceException is thrown, instead of HTTP 401.
This commit deprecates the current behavior and introduces an opt-in
(Server)AuthenticationEntryPointFailureHandlerAdapter with the expected
behavior.
BearerTokenAuthenticationFilter uses the new adapter, but with a closure
to keep the current behavior re: entrypoint.
2022-10-13 19:25:04 -06:00
14584b0562
Add SecurityContextHolderStrategy to OAuth2
...
Issue gh-11060
2022-10-05 23:50:54 -06:00
7f0140278e
Add native hint for OAuth2 Client's schemas
...
Closes gh-11920
2022-09-29 10:01:51 -03:00
181ee7410b
Change default authority for oauth2Login()
...
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.
* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER
Documentation has been updated to include this implementation detail.
Closes gh-7856
2022-09-26 10:06:31 -05:00
7527fd811c
Merge branch '5.8.x'
2022-09-26 09:56:55 -05:00
bbac85e20b
Reduce severity of invalid registrationId to warn
...
This prevents filling the log file with error messages when routine
scans are being performed.
Closes gh-11344
2022-09-26 09:56:20 -05:00
ae6fb8c681
Add Deprecated Versions of Original Classes
...
Issue gh-7349
2022-09-23 16:31:22 -06:00
37a160245f
Adjust OAuth2 Resource Server packaging
...
Closes gh-7349
2022-09-23 16:31:21 -06:00
53dbcfd457
Add Deprecated Versions of Original Classes
...
Issue gh-7349
2022-09-23 12:06:59 -06:00
3c66ef6305
Change default SecurityContextRepository
...
Save SecurityContext in request attributes for stateless session
management using RequestAttributeSecurityContextRepository.
Closes gh-11026
2022-09-22 17:31:14 -05:00
70460ca009
Adjust OAuth2 Resource Server packaging
...
Closes gh-7349
2022-09-20 17:44:05 -06:00
fee1ffa422
Fix JSONObject and JSONArray imports in tests
...
Issue gh-11858
2022-09-16 15:57:43 -03:00
67a00bcaa0
Fix JSONObject and JSONArray imports in tests
2022-09-16 13:38:57 -05:00
c6458c35aa
Merge branch '5.8.x'
2022-09-14 15:12:21 -05:00
bea7761a1c
ClientRegistrations#rest defines 30s connect and read timeouts
2022-09-14 15:10:34 -05:00
2431dd1103
Merge branch '5.8.x'
2022-09-13 17:38:10 -05:00
355ef21117
Polish gh-11665
2022-09-13 16:45:39 -05:00
1efb63387f
Add authentication converter for introspected tokens
...
Adds configurable authentication converter for resource-servers with
token introspection (something very similar to what
JwtAuthenticationConverter does for resource-servers with JWT decoder).
The new (Reactive)OpaqueTokenAuthenticationConverter is given
responsibility for converting successful token introspection result
into an Authentication instance (which is currently done by a private
methods of OpaqueTokenAuthenticationProvider and
OpaqueTokenReactiveAuthenticationManager).
The default (Reactive)OpaqueTokenAuthenticationConverter, behave the
same as current private convert(OAuth2AuthenticatedPrincipal principal,
String token) methods: map authorities from scope attribute and build a
BearerTokenAuthentication.
Closes gh-11661
2022-09-13 16:45:36 -05:00
f84f08c4b9
Default HttpSessionRequestCache.matchingRequestParameterName=continue
...
Closes gh-11757
2022-08-26 14:44:55 -05:00
32dbaceec5
Fix mockito 4.7.0 merge
...
Issue gh-11748
2022-08-24 08:58:00 -05:00
670b71363d
Merge branch '5.8.x'
...
Closes gh-11749
2022-08-23 16:03:50 -05:00
2fb625db84
Remove mockito deprecations
...
Issue gh-11748
2022-08-23 15:59:52 -05:00
7c7f9380c7
Refresh remote JWK when unknown KID error occurs
...
Closes gh-11621
2022-08-18 16:54:45 -05:00
888715bbb2
Add tests for unknown KID error
...
Issue gh-11621
2022-08-18 16:54:45 -05:00
53a3ff8932
Refresh remote JWK when unknown KID error occurs
...
Closes gh-11621
2022-08-18 16:53:45 -05:00
77d11a3f9f
Add tests for unknown KID error
...
Issue gh-11621
2022-08-18 16:53:44 -05:00
51dc672625
Refresh remote JWK when unknown KID error occurs
...
Closes gh-11621
2022-08-18 16:48:42 -05:00
d1c742d7aa
Add tests for unknown KID error
...
Issue gh-11621
2022-08-18 16:48:41 -05:00
9c02e835e8
Refresh remote JWK when unknown KID error occurs
...
Closes gh-11621
2022-08-18 16:42:57 -05:00
3e73fa6954
Add tests for unknown KID error
...
Issue gh-11621
2022-08-18 16:42:57 -05:00
2e66b9f6cc
Allow customization of redirect strategy
...
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.
Closes gh-11373
2022-08-08 15:44:01 -05:00
efaee4e56b
Allow customization of redirect strategy
...
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.
Closes gh-11373
2022-08-08 15:35:49 -05:00
b5b3ddd6b4
Deprecate Resource Owner Password Credentials grant
...
Closes gh-11590
2022-07-15 16:45:00 -04:00
95155ddb0c
Deprecate Resource Owner Password Credentials grant
...
Closes gh-11590
2022-07-15 16:28:47 -04:00
6ee1643bae
Remove deprecations in ServerOAuth2AuthorizedClientExchangeFilterFunction
...
Closes gh-11589
2022-07-15 15:13:40 -04:00
054791c26c
Remove deprecations in ServletOAuth2AuthorizedClientExchangeFilterFunction
...
Closes gh-11588
2022-07-15 15:12:39 -04:00
65db5fa028
Remove deprecations in JwtAuthenticationConverter
...
Closes gh-11587
2022-07-15 14:43:08 -04:00
1ac6054e6f
Remove deprecations in OidcUserInfo
...
Closes gh-11586
2022-07-15 14:42:54 -04:00
6b41faaf55
Remove deprecations in ClaimAccessor
...
Closes gh-11585
2022-07-15 14:42:33 -04:00
Josh Cummings
Nick Meverden
Vedran Pavic
Marcus Kainth
Joe Grandja
Steve Riesenberg
Geon Park
Marcus Da Coregio
luamas
Jon Kjennbakken
ch4mpy
Patrick Walter
이경욱
Michael Sosa
Ger Roza
Daniel Garnier-Moiroux
Daniel Garnier-Moiroux
Rob Winch
tinolazreg
Igor Bolic