8bac87fb20
Merge branch '6.3.x'
2024-10-23 15:24:32 -07:00
c104f44546
Merge branch '6.2.x' into 6.3.x
2024-10-23 15:23:15 -07:00
18dba34bde
Make RequestMatcherDelegatingAuthorizationManager Post-Processable
...
Closes gh-15948
2024-10-23 15:15:10 -07:00
b0e8730d70
Add Passkeys Support
...
Closes gh-13305
2024-10-20 22:54:53 -05:00
7f537241e7
Use SessionAuthenticationStrategy for Remember-Me authentication
...
Closes gh-2253
2024-10-15 14:07:07 -07:00
d37d41c130
Polish One-Time Token API Names and Doc
...
The names of variables and methods have been adjusted in accordance with the names of the one-time token login API components.
Issue gh-15114
2024-10-15 14:04:56 -07:00
e9fe6360bc
Add Reactive One-Time Token Login Kotlin DSL Support
...
Closes gh-15887
2024-10-15 14:04:56 -07:00
c40334317d
Polish One-Time Token Component Names
...
Aligning parts of speech so that names are using nouns/verbs
where comparable components are using nouns/verbs.
Issue gh-15114
2024-10-14 14:07:47 -06:00
b8aa78829c
Improve readability of empty collection checks
2024-10-14 12:16:39 -07:00
31f8caec5f
Polish diamond operator usage
2024-10-14 11:51:35 -07:00
9ce5a76e8c
Polish AuthorizationManager#authorize
...
Issue gh-14843
2024-10-14 11:48:57 -07:00
e7644925f8
Add AuthorizationResult support for AuthorizationManager
...
Closes gh-14843
2024-10-14 11:48:57 -07:00
702538ebce
AuthorizationEventPublisher Accepts AuthorizationResult
...
Closes gh-15915
Co-authored-by: Max Batischev <mblancer@mail.ru>
2024-10-14 11:48:57 -07:00
ef1226ddf8
Use Oauth2UserService bean in OidcReactiveOAuth2UserService
...
Closes gh-15846
2024-10-14 11:41:04 -07:00
2edaedf099
Improve encapsulation for jwtValidators
2024-10-07 16:41:50 -07:00
b26f2af5d5
Polish
...
Formatting as well as adding a missing defer
Issue gh-15699
2024-10-07 16:39:54 -07:00
2ca2e56383
Add Reactive One-Time Token Login support
...
Closes gh-15699
2024-10-07 16:39:54 -07:00
aceb5fa6bb
Allow logout+jwt JWT type for reactive
...
The OIDC back-channel spec recommends using a logout token typ `logout+jwt`
(see [here](https://openid.net/specs/openid-connect-backchannel-1_0-final.html#LogoutToken ).
Support of this type was recently added [on the servlet side]([on the Servlet side](9101bf1f7d
2024-09-30 16:32:45 -07:00
29331a0d8c
Merge branch '6.3.x'
2024-09-30 17:24:03 -06:00
746464e035
Merge branch '6.2.x' into 6.3.x
2024-09-30 17:21:13 -06:00
c1857c0308
Fix Formatting
...
Issue gh-15771
2024-09-30 16:19:26 -07:00
690e012fb1
Improve OidcBackChannelLogoutTokenValidator error when provider issuer is missing
...
Closes gh-15771
2024-09-30 16:19:26 -07:00
8b97fdde43
Polish OAuth2ClientConfiguration
2024-09-30 16:16:45 -07:00
ee9a887ae5
Fix Package Tangle
...
Move ObjectPostProcessor to be alongside Customizer, another
functional interface for describing Spring Security object
configuration.
2024-09-26 14:08:25 -06:00
d6b620b9f7
Make Observations Selectable
...
Closes gh-15678
2024-09-26 11:30:40 -06:00
69e3c248fa
Abstract ObservationRegistry Behind ObjectPostProcessor
...
Issue gh-15678
2024-09-26 11:30:40 -06:00
1ed20aa210
Add ObservationRegistry Tests
...
Issue gh-11989
Issue gh-11990
2024-09-26 11:30:40 -06:00
717529deb4
Add Generic Type to ObjectPostProcessor Lookups
...
Issue gh-15678
2024-09-26 11:30:39 -06:00
e618fc425d
Favor ObjectProvider
...
Closes gh-15805
2024-09-23 16:11:43 -07:00
9dda65a5e3
Polish CorsSpecTests
...
Use concrete ApplicationContext to simplify future maintenance.
Issue gh-4832
2024-09-23 16:11:43 -07:00
cd7f6e09b0
Look up ReactiveOAuth2AccessTokenResponseClient as a bean
...
Closes gh-11097
2024-09-23 11:06:12 -05:00
22dffc0a98
Run format
2024-09-20 09:06:37 -07:00
0a0721b030
Complete HttpSecurity Deprecation notices
2024-09-20 09:06:37 -07:00
a88a7744ed
Require GeneratedOneTimeTokenHandler on constructor
...
Issue gh-15114
2024-09-17 08:21:26 -03:00
b311b811a1
Pick Up OidcSessionRegistry Bean
...
Closes gh-15813
2024-09-15 21:30:55 -07:00
590aef0af1
Configure OidcSessionRegistry in Kotlin
...
Closes gh-15814
2024-09-15 21:30:55 -07:00
8bb5875595
Expose OidcBackChannelLogoutHandler
...
This component already uses by default a URI that doesn't require
a CSRF token and aalready allows for configuring a cookie name.
So, by making it public and configurable in the DSL, both
of these tickets quite naturally close.
Closes gh-13841
Closes gh-14904
2024-09-15 21:30:55 -07:00
2d4c498c3b
Test Meta-Annotation Class Type Support in Reactive
...
Issue gh-15747
2024-09-15 21:30:55 -07:00
75fd84ce16
Test Reactive Method Security Exactly-One Invocation Semantics
...
Issue gh-15651
2024-09-15 21:30:55 -07:00
1aec571a81
Test Reactive Method Security Exactly Once Semantics
...
Issue gh-15592
2024-09-15 21:30:55 -07:00
3e1f8bb960
Test Reactive Method Security with Abstract Classes
...
Issue gh-15352
2024-09-15 21:30:55 -07:00
fee5dd30c0
Test AuthorizeReturnObject in Reactive
...
Issue gh-14597
2024-09-15 21:30:55 -07:00
fc2ad34e5d
Test meta-annotation parameter support in Reactive
...
Issue gh-14480
2024-09-15 21:30:55 -07:00
6f5e103dec
Use AnnotationTemplateExpressionDefaults in Reactive
...
Issue gh-15097
2024-09-15 21:30:55 -07:00
86f64e7e86
Add Reactive Authorization Proxy Data Hints
...
Issue gh-15709
2024-09-15 21:30:55 -07:00
2bb3787d2b
Use addAdvisors in Reactive Proxy Configuration
...
Issue gh-15497
2024-09-15 21:30:55 -07:00
0618d4e03f
Provide Runtime Hints for Beans used in Pre/PostAuthorize Expressions
...
Closes gh-14652
2024-09-13 08:42:14 -03:00
51c226f24c
Add loginPage() to DSL in reactive oauth2Login()
...
Closes gh-15674
2024-09-11 15:56:54 -05:00
9e5cc5f267
Merge remote-tracking branch 'origin/6.3.x'
2024-09-11 15:14:45 -05:00
51d0a8b57d
Fix getBeansWithName in global authentication configurers
2024-09-11 10:46:24 -07:00
7e41785dfc
Remove trailing spaces in default UIs
...
- Default UIs had blank lines with only spaces. These get deleted by the
spring-javaformat plugin. In order to avoid this behavior, an extra \s
had been inserted in the tests. The reason for those \s is not obvious.
- This commit cleans up the \s but changing the HTML templates.
2024-09-11 10:44:45 -07:00
85693b2806
Add DefaultResourcesFitler to XML configuration
2024-09-11 10:21:12 -07:00
63f018eb18
Update tests using deprecated classes
...
Issue gh-15737
2024-09-10 15:10:42 -05:00
c1b9035544
Use static CSS in OneTimeToken default UI
2024-09-10 12:46:13 -07:00
45d53973ab
Serve static content (css, js) for reactive default UIs from DefaultResourcesWebFilter
2024-09-10 12:46:13 -07:00
11616a1d78
Use static CSS in servlet default UI
2024-09-10 12:46:13 -07:00
c5c5cd5ed0
Serve static content (css, js) for default UIs from DefaultResourcesFilter
2024-09-10 12:46:13 -07:00
be6dc1d2bf
Polish MethodSecurityExpressionHandler Test
...
- Rename to follow convention
- Use a mock object to verify usage
Issue gh-15715
2024-09-10 13:12:47 -06:00
ef8b0addbb
Support custom MethodSecurityExpressionHandler
...
Closes gh-15715
2024-09-10 12:01:29 -07:00
e29058c7e4
Add AuthorizeReturnObject Spring Data Hints
...
Issue gh-15709
2024-09-10 11:57:31 -07:00
fd5d03d384
Add AuthorizeReturnObject Hints
...
Closes gh-15709
2024-09-10 11:57:31 -07:00
6428bf2bd8
Add test for rendering "request token" form in OneTimeTokenLoginConfigurerTests
2024-09-06 09:13:30 -03:00
803c32eb4e
Remove unused logger in OneTimeTokenLoginConfigurer
2024-09-06 09:13:30 -03:00
8d47906191
Render default UIs using lightweight templates
2024-09-05 15:02:42 -07:00
a953a3d162
Remove log message
2024-09-05 16:40:26 -03:00
c0a10b90ba
Merge remote-tracking branch 'origin/6.3.x'
2024-09-04 14:48:23 -06:00
5c20505b0e
Support Class Attributes in Annotation Template Processing
...
Closes gh-15721
2024-09-04 13:41:46 -07:00
81e4c7273a
Add One-Time Token Login support to Kotlin DSL
...
Closes gh-15698
2024-09-04 09:13:38 -03:00
db04b5a248
Merge branch '6.3.x'
2024-09-03 16:34:09 -06:00
ff41521e1e
Merge branch '6.2.x' into 6.3.x
2024-09-03 16:33:46 -06:00
b22061d0b6
Merge branch '5.8.x' into 6.2.x
2024-09-03 16:33:22 -06:00
97cefa6830
Update Formatting
...
Issue gh-15714
2024-09-03 15:32:59 -07:00
f836efb912
Address unnecessary method invocation
...
Closes gh-15714
2024-09-03 15:32:59 -07:00
00e4a8fb54
Add support for One-Time Token Login
...
Closes gh-15114
2024-09-03 10:07:56 -03:00
f0f47b54ec
Improve warning message
2024-08-31 16:48:59 -07:00
d2e8c19789
Merge branch '6.3.x'
2024-08-26 16:33:04 -06:00
279cb89eac
Merge branch '6.2.x' into 6.3.x
2024-08-26 16:32:58 -06:00
f372f5cf52
Replace OidcSessionStrategy References with OidcSessionRegistry
2024-08-26 15:32:35 -07:00
dff3780c5e
Merge branch '6.3.x'
2024-08-22 12:38:17 -06:00
4c0d969f1f
Merge branch '6.2.x' into 6.3.x
...
Closes gh-15676
2024-08-22 12:37:45 -06:00
3ee5a96e53
Merge branch '5.8.x' into 6.2.x
...
Closes gh-15675
2024-08-22 12:24:56 -06:00
5c604b95fb
Correct PostFilterAuthorizationMethodInterceptor Target Type
...
Previously, `postFilterAuthorizationMethodInterceptor` mistakenly
was published as an `Advisor`. Because `MethodSecurityAdvisorRegistrar`
re-publishes each pre/post annotation interceptor also as an `Advisor`,
this resulted in a duplicate advisor for `@PostFilter`.
Closes gh-15651
2024-08-22 12:10:25 -06:00
f398be793d
Simplify AuthorizationAdvisorProxyFactory Configuration
...
Closes gh-15497
2024-08-19 12:34:38 -06:00
6352877bc4
Merge branch '6.3.x'
2024-08-19 12:34:32 -06:00
ae8e4d148e
Produce Exactly One AuthorizationAdvisor Per Annotation
...
Closes gh-15592
2024-08-19 12:30:03 -06:00
27af1df87d
Simplify Method Interceptor Configuration
...
Simplifies to use only one ObjectProvider for easier
future maintenance
Issue gh-15592
2024-08-19 12:27:56 -06:00
b731623b3a
Fix checkstyle errors with @Deprecated
2024-08-19 10:55:58 -03:00
b92ed92548
Fix checkstyle errors with @Deprecated
2024-08-19 10:55:28 -03:00
912062d307
Merge branch '6.2.x' into 6.3.x
2024-08-19 09:11:10 -03:00
79fb0113c8
Bump io-spring-javaformat from 0.0.42 to 0.0.43
...
Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43.
Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)
Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)
---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
dependency-type: direct:production
update-type: version-update:semver-patch
...
---
Manual updates:
- Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST
be used together
Signed-off-by: dependabot[bot] <support@github.com>
2024-08-19 09:11:05 -03:00
2caf1fb6b4
Bump io-spring-javaformat from 0.0.42 to 0.0.43
...
Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43.
Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)
Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)
---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
dependency-type: direct:production
update-type: version-update:semver-patch
...
---
Manual updates:
- Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST
be used together
Signed-off-by: dependabot[bot] <support@github.com>
2024-08-19 09:08:24 -03:00
ed16c86115
Improve @CurrentSecurityContext meta-annotations
...
Closes gh-15551
2024-08-13 13:18:15 -06:00
59ec1f6480
Revert "Polish AuthorizationAdvisorProxyFactory advisor configuration"
...
This commit had some unintended consequences when the advisor
interceptor was published in a Spring Boot application. As such,
15497 will be reopened to investigate. In the meantime, this commit
reverts the previous change so as to allow the build to pass.
Issue gh-15497
2024-08-12 10:12:14 -06:00
08b8b09066
Update Copyright
...
Issue gh-15286
2024-08-10 11:48:14 -06:00
2b33f6f04a
Add Config Tests for AuthenticationPrincipal Templates
...
Issue gh-15286
2024-08-10 11:46:51 -06:00
e40c98e6d7
Deprecate PrePostTemplateDefaults
...
Since there is nothing specific to configuring pre/post
annotations, there is no need for the extra class.
If a need like this does arise in the future,
either AnnotationTemplateExpressionDefaults can be sub-
classed, or it can have introduced a Map field holding
custom properties.
Issue gh-15286
2024-08-10 11:46:51 -06:00
2c02d8aec7
Update Copyright
2024-08-10 11:46:51 -06:00
895978c818
Auto config AuthenticationPrincipalArgumentResolver When AnnotationTemplateExpressionDefaults bean is Present
2024-08-10 11:46:51 -06:00
71f40f2bc4
Merge branch '6.3.x'
...
Use explicit types instead of var
Closes gh-155537
2024-08-08 15:30:16 -05:00
3b8cdc323f
Remove unused method
2024-08-08 15:29:41 -05:00
Josh Cummings
Scott Murphy Heiberg
Rob Winch
xhaggi
Max Batischev
kwonyonghyun
Tran Ngoc Nhan
DingHao
Cedric Montfort
chao.wang
Thomas Darimont
Steve Riesenberg
Ryan Scheidter
Marcus Hert Da Coregio
Daniel Garnier-Moiroux
Max Batischev
tugjg
Yanming Zhou
Hero Wanders