12f320851d
Set openid scope in OAuth2LoginTests
2018-12-21 09:24:55 -06:00
8f4f52edb9
Support configurable JwtDecoder for IdToken verification
...
Fixes gh-5717
2018-12-21 09:24:55 -06:00
e60ae4984a
Add hasAnyAuthority() and hasAnyRole() in AuthorizeExchangeSpec
...
Fixes gh-6306
2018-12-19 09:55:47 -06:00
3bcb1d9458
Allow setting authenticationEntryPoint for Http Basic
...
1. Added method authenticationEntryPoint in ServerHttpSecurity to allow
setting authenticationEntryPoint.
2. Added test in ServerHttpSecurityTests to check if
if specified realm name set by authenticationEntryPoint is
returned
Fixes: gh-6270
2018-12-17 11:24:11 -06:00
2b369cfe98
Added support for Anonymous Authentication
...
1. Created new WebFilter AnonymousAuthenticationWebFilter to
for anonymous authentication
2. Created class AnonymousSpec, method anonymous to configure
anonymous authentication in ServerHttpSecurity
3. Added ANONYMOUS_AUTHENTICATION order after AUTHENTICATION for
anonymous authentication in SecurityWebFiltersOrder
4. Added tests for anonymous authentication in
AnonymousAuthenticationWebFilterTests and ServerHttpSecurityTests
5. Added support for Controller in WebTestClientBuilder
Fixes: gh-5934
2018-12-12 16:05:30 -06:00
9a357f8cb6
Moved CachingUserDetailsService to spring-core
...
Made CachingUserDetailsService constructor public and moved to spring-core to make it easier to configure caching in UserDetailsService
Fixes gh-4139
2018-12-11 13:22:08 -06:00
56eb658eae
RoleVoter Configuration Defaults Prefix Using GrantedAuthorityDefauts
...
Fixes: gh-4876
2018-12-07 14:17:44 -06:00
8b3fb55aea
Added methods to add filter relatively in ServerHttpSecurity
...
Addition of two new methods addFilterBefore and addFilterAfter in
ServerHttpSecurity to allow addition of WebFilter before and after of
specified order
Fixes: gh-6138
2018-12-04 13:29:53 -06:00
6bddb38cac
Update to Gradle 5.0
...
Change project's gradle version to 5.0, this requires to make some minor
adjustments.
Fixes: gh-6148
2018-11-30 08:50:47 -06:00
b8f038e86a
Polish OAuth2ResourceServerConfigurer
2018-11-30 06:37:00 -05:00
be423debfd
ServerAuthenticationConverter should be configurable
...
Fixes gh-6186
2018-11-29 14:37:22 -07:00
3a43ed8f1c
Register NullRequestCache When Disabled
...
Fixes: gh-6102
2018-11-20 07:15:09 -07:00
f30fcdda6b
RequestCacheConfigurerTests groovy->java
...
Issue: gh-4939
2018-11-16 15:40:12 -07:00
686393ed5c
ExceptionHandlingConfigurerTests groovy->java
...
Issue: gh-4939
2018-11-16 14:51:26 -07:00
1ea73e7d8e
Jwt Decoder Local Key Configuration
...
Adds support for configuring Resource Server DSL with a local public
key.
Fixes: gh-5131
2018-11-16 13:07:19 -06:00
d28e32b000
NimbusJwtDecoder Builder
...
A Builder to simply common construction patterns for NimbusJwtDecoder
Issue: gh-6010
2018-11-14 15:53:47 -06:00
db5e54266c
#3912 lazyBean method respects @Primary annotation
2018-11-14 14:31:29 -06:00
8eedb3919e
Policy OAuth2ResourceServerSpecTests
...
Issue: gh-6052
2018-11-12 15:01:15 -07:00
3a6582d2a6
Fix csrf:token-repository-ref XSD documentation
...
The documentation of the token-repository-ref attribute of the csrf
element in the schema has been updated to make clear the default
repository is lazy. Targets versions 4.2, 5.0 and 5.1.
Fixes gh-6037
2018-11-08 10:14:49 -06:00
9a13f9acde
Custom Bearer Token Error Handling Support
...
Users can specify a custom access denied handler and authentication
entry point for reactive resource servers.
Fixes: gh-6052
2018-11-07 16:29:56 -06:00
75e7e099ab
MiscHttpConfigTests groovy->java
...
Issue: gh-4939
2018-10-30 12:58:20 -06:00
52be2839ca
Migraged unit test from groovy to java
...
Moved AbstractConfigAttributeRequestMatcherRegistryTests.groovy to AbstractConfigAttributeRequestMatcherRegistryTests.java
gh-4939
2018-10-23 20:04:42 -05:00
8ef65ce5c5
Set AuthenticationEventPublisher on each AuthenticationManagerBuilder
...
Fixes gh-6009
2018-10-23 14:08:23 -04:00
8f49ca850a
Fixing IllegalStateException message in OAuth2ResourceServerConfigurer
...
Updated message to include `http.oauth2ResourceServer()`
2018-10-17 15:14:36 -05:00
bd9e3877f9
JDK 10 Compatibility
...
Upgrading dependencies and reconfiguring PowerMock
Issue: gh-5860
2018-10-17 15:03:42 -05:00
921abefaa2
Remove address and phone scope from CommonOAuth2Provider.OKTA
...
Fixes gh-5987
2018-10-17 11:50:34 -04:00
22bd8f1c1f
Reactive Jwt Authentication Converter Support
...
Fixes: gh-5092
2018-10-15 11:55:12 -05:00
93ca455405
OAuth2LoginAuthenticationFilter ignores authenticated Users
...
This ensures that OAuth2 Client support works with the same log in URL as
oauth2 login.
Fixes: gh-5915
2018-10-12 16:29:27 -05:00
5d18bb68ed
Add @formatter to @EnableWebFluxSecurity Javadoc
...
Fixes: gh-5898
2018-09-21 08:11:50 -05:00
45a9c0fd54
Polish Automatically Add CsrfServerLogoutHandler
...
Issue: gh-5337
2018-09-21 00:59:36 -05:00
b060ec050a
Automatically add CsrfServerLogoutHandler if csrf enabled
...
The configuration DSL should automatically add CsrfServerLogoutHandler if csrf is enabled
Fixes gh-5337
2018-09-21 00:59:36 -05:00
79828d4f7b
Polish WebFlux Referrer-Policy header config
2018-09-20 17:14:16 -05:00
8a49c431c3
Add OAuth2ClientSpec.and
...
Fixes: gh-5888
2018-09-20 10:19:21 -05:00
73c1abbba0
EnableGlobalMethodSecurity Misconfiguration Check
...
This polishes the EnableGlobalMethodSecurity misconfiguration check to
not error if the user has specified a custom method security metadata
source.
Issue: gh-5341
2018-09-20 07:55:03 -06:00
1e864ad764
Validate @EnableGlobalMethodSecurity usage
...
Fixes: gh-5341
2018-09-20 07:55:03 -06:00
9e0c7f17b7
Default RequestCache should ignore favicon
...
Fixes: gh-5875
2018-09-19 14:29:14 -05:00
8b0a3a760c
Use providedSessionAuthenticationStrategy
...
Fixes gh-5763
2018-09-19 07:04:49 -04:00
501c008526
Add WebFlux Redirect to HTTPS Reference
...
Fixes: gh-5869
2018-09-18 21:12:37 -05:00
54d07b6b8b
Add WebFlux HTTP Headers Reference
...
Fixes: gh-5868
2018-09-18 17:09:41 -05:00
72301e548a
Reactive OAuth2 DSL Customizations
...
Fixes: gh-5855
2018-09-17 21:21:36 -05:00
385bdfc055
OAuth2AuthorizationCodeGrantWebFilter works with /{action}/
...
This ensures that the same URL can work for both log in and
authorization code which prevents having to create additional registrations
on the client and potentially on the server (GitHub only allows a single
valid redirect URL).
Fixes: gh-5856
2018-09-17 21:21:36 -05:00
68bc649a45
Fix XsdDocumentedTests
...
Issue: gh-5836
2018-09-12 19:56:30 -05:00
42327a0aec
Polish OAuth2ResourceServerConfigurerTests
2018-09-10 13:24:16 -06:00
2c982a4168
Reactive Redirect to Https
...
This introduces the capability to configure Reactive Spring Security
to upgrade requests to HTTPS
Fixes: gh-5749
2018-09-07 14:25:58 -05:00
f164f2f869
Polish FilterComparator
...
Extracts STEP incrementing into a separate helper class
2018-09-07 10:30:57 -06:00
438d2911fb
OAuth2AuthorizedClientResolver
...
Extract out a private API for shared code between the argument resolver
and WebClient support. This makes it easier to make changes in both
locations. Later we will extract this out so it is not a copy/paste
effort.
Issue: gh-4921
2018-09-07 08:58:00 -05:00
07b6699fd9
ServerWebExchangeReactorContextWebFilter
...
Fixes: gh-5779
2018-09-07 08:49:27 -05:00
c60fcf263e
provide test for custom principal extractor config
...
Signed-off-by: Sola <dev@sola.love>
2018-09-05 15:51:14 -05:00
2980f96b55
Allow PrincipalExtractor to be customized.
...
Signed-off-by: Sola <dev@sola.love>
2018-09-05 15:51:14 -05:00
932ea245fb
AuthenticationManager for OAuth2ResourceServerSpec
...
This makes the AuthenticationManager used by the OAuth2 Resource
Server configurable, focusing at this point on the Jwt use case.
Fixes: gh-5750
2018-09-05 09:19:11 -05:00
25d1f49d84
Remove Resource Server's Session Policy Config
...
Resource Server doesn't need to set the session policy for the
application to STATELESS since it can rely on the
SessionManagementFilter ignoring token's annotated with @Transient,
which a JwtAuthenticationToken is.
Fixes: gh-5759
2018-09-04 14:55:40 -06:00
8510e9a285
Reactive Resource Server insufficient_scope
...
This introduces an implementation of ServerAccessDeniedHandler that is
compliant with the OAuth 2.0 spec for insufficent_scope errors.
Fixes: gh-5705
2018-08-31 10:33:11 -05:00
229b69dd35
Add DefaultAuthorizationCodeTokenResponseClient
...
Fixes gh-5547
2018-08-27 12:44:19 -04:00
cb0ba58b58
Fix WhitespaceAfterCheck Checkstyle check
2018-08-27 10:45:35 -05:00
1640a1f462
Polish ServerAuthenticationConverter
...
Fix package tangles
Issue: gh-5338
2018-08-24 09:44:27 -05:00
68d836d508
Reactive Resource Server Csrf Bypass
...
This makes requests identified as bearer token requests skip the csrf
filter.
Fixes: gh-5710
2018-08-24 09:44:01 -05:00
820fb7d828
Polish formatting ServerHttpSecurity JwtSpec
...
Fixes: gh-5728
2018-08-23 15:12:19 -05:00
cba2444e1a
ServerHttpSecurity ReactiveJwtDecoder discovery
...
This makes so that WebFlux OAuth 2.0 Resource Server configuration
will pick up a ReactiveJwtDecoder exposed as a bean.
Fixes: gh-5720
2018-08-23 15:12:14 -05:00
0fdc081ab5
Add unit tests
...
Added some unit tests around some untested parts of the code that I
will be touching for this issue.
Issue: gh-5720
2018-08-23 15:11:40 -05:00
ff6e1232c8
Flatten HttpSecurity.oauth2()
...
Fixes gh-5715
2018-08-22 05:58:04 -04:00
0f89e59707
Simplified oauth2().client() DSL
...
Fixes gh-5662
2018-08-22 04:45:35 -04:00
0dc80aed40
Flatten ServerHttpSecurity.oauth2()
...
Fixes: gh-5712
2018-08-21 15:48:41 -05:00
53652584b2
ResourceServerSpec->OAuth2ResourceServerSpec
...
Fixes: gh-5713
2018-08-21 14:51:22 -05:00
c3e19e29b5
Remove authorizationEndpoint.baseUri in OAuth2ClientConfigurer
...
Fixes gh-5661
2018-08-21 15:33:58 -04:00
f382b69507
Add reactive support for Referrer-Policy security header
2018-08-20 10:10:59 -05:00
10621a0f2c
Add reactive support for Content-Security-Policy security header
2018-08-20 10:03:42 -05:00
29cfc3dd1d
Add reactive support for Feature-Policy security header
...
Closes gh-5672
2018-08-20 09:02:12 -05:00
b9ab4929b7
Add OAuth2AuthorizationCodeGrantWebFilter
...
Issue: gh-5620
2018-08-19 21:12:41 -05:00
d0ebe47cd5
OAuth2LoginReactiveAuthenticationManager uses OAuth2AuthorizationCodeReactiveAuthenticationManager
...
Issue: gh-5620
2018-08-19 21:12:32 -05:00
f843da1942
Add OAuth2LoginAuthenticationWebFilter
...
This is necessary so that the saving of the authorized client occurs
outside of the ReactiveAuthenticationManager. It will allow for
saving with the ServerWebExchange when ReactiveOAuth2AuthorizedClientRepository
is added.
Issue: gh-5621
2018-08-19 21:11:43 -05:00
dd7925cb63
OAuth2AuthorizedClientArgumentResolver Uses ServerOAuth2AuthorizedClientRepository
...
Issue: gh-5621
2018-08-19 21:11:24 -05:00
b02ce59188
TestClientRegistrations
...
Fixes: gh-5651
2018-08-19 21:08:02 -05:00
5ddb25fff8
Consistent .server package for ServerWebExchange OAuth2
...
Fixes: gh-5663
2018-08-19 21:05:55 -05:00
e3eaa99ad0
Polish ServerAuthenticationConverter
...
Update changes for ServerAuthenticationConverter to be passive.
Issue: gh-5338
2018-08-18 19:55:39 -05:00
46f71cc232
Update to assertj 3.11.0
...
Fixes: gh-5686
2018-08-17 21:10:47 -05:00
2c27e18eb3
GlobalMethodSecurityConfiguration uses BeanFactoryAware
...
This works around an issue found when updating to
Spring 5.1.0.RC2
Issue: gh-5679
2018-08-17 21:09:37 -05:00
ff8163f4c7
Run rnc generation after Feature-Policy Support
...
After the Feature-Policy support changes the format of the xsd did not
align with the generator which meant running the build caused changes
for the commit.
This commit ran the xsd generation so that the formatting would be
consistent with the generator.
Issue: gh-5670
2018-08-17 11:20:26 -05:00
d610f31425
Jwt -> Authentication Conversion
...
Exposes ability to specify a strategy for converting Jwt into an
Authentication, specifically in JwtAuthenticationProvider.
Fixes: gh-5629
2018-08-17 11:04:27 -05:00
938dbbf424
Add OAuth2AuthorizationRequestResolver.resolve(HttpServletRequest,String)
...
Previously there was a tangle between
DefaultOAuth2AuthorizationRequestResolver and
OAuth2AuthorizationRequestRedirectFilter with
AUTHORIZATION_REQUIRED_EXCEPTION_ATTR_NAME
This commit adds a new method that can be used for resolving the
OAuth2AuthorizationRequest when the client registration id is known.
Issue: gh-4911
2018-08-16 20:41:13 -05:00
7c524aa0c8
Jwt Claim Validation
...
This introduces OAuth2TokenValidator which allows the customization of
validation steps that need to be performing when decoding a string
token to a Jwt.
At this point, two validators, JwtTimestampValidator and
JwtIssuerValidator, are available for use.
Fixes: gh-5133
2018-08-16 13:19:26 -05:00
c6ea447cc0
Add support for Feature-Policy security header
2018-08-16 09:31:02 -05:00
a4bd0d3923
OIDC Provider Configuration - ClientRegistrations
...
OIDC Provider Configuration is now being used to create more than just
ClientRegistration instances. Also, the endpoint is being addressed in
more contexts than just the client.
To that end, this refactors OidcConfigurationProvider in the config
project to ClientRegistrations in the oauth2-client project.
Fixes: gh-5647
2018-08-14 13:26:46 -06:00
950a314c9f
RememberMeConfigTests groovy->java
...
Issue: gh-4939
2018-08-10 11:17:54 -06:00
68878a1675
Replace isEqualTo(null) with isNull()
2018-08-09 18:04:48 -06:00
4de3d0b860
Create AuthorizationEndpointConfig.configure
...
Issue: gh-5654
2018-08-08 16:02:40 -05:00
52622bc6dd
Move OAuth2ClientConfigurer.configure to AuthorizationCodeGrantConfigurer
...
Issue: gh-5654
2018-08-08 16:02:34 -05:00
952743269d
Add support for client_credentials grant
...
Fixes gh-4982
2018-08-08 08:06:47 -05:00
14a7387190
Made JwtConfigurer fluent
...
Adjusted return type of #decoder(JwtDecoder) and #jwkSetUri(String)
to return the JwtDecoder itself. Added new method #and() that returns
the enclosing OAuth2ResourceServerConfigurer.
Fixes gh-5595
2018-08-08 08:28:26 -04:00
6a2dd78f88
Regenerate spring-security-5.1.xsd
...
Commit 884fdbf9
2018-08-03 10:57:54 -05:00
4e8f2a3ee4
Add @Configuration to ServerHttpSecurityConfiguration
...
Fixes: gh-5635
2018-08-03 09:37:03 -05:00
cecbc2175b
Add CORS WebFlux Support
...
Fixes: gh-4832
2018-07-31 11:37:50 -05:00
afa2d9cbc7
Remove ExchangeFilterFunctions
...
Issue: gh-5612
2018-07-30 15:34:44 -05:00
6d0369647b
Add OAuth2LoginSpec.and()
...
Fixes: gh-5609
2018-07-30 12:07:51 -05:00
e215d2733f
Add OAuth2Spec
...
Issue: gh-5605
2018-07-30 11:39:45 -05:00
f3c9cce56d
Rename to WebClientAuthorizationCodeTokenResponseClient
...
Rename NimbusReactiveAUthorizationCodeTokenResponseClient to
WebClientReactiveAuthorizationCodeTokenResponseClient
Fixes: gh-5529
2018-07-26 15:14:11 -05:00
1c8a931e33
Rename to OidcAuthorizationCodeReactiveAuthenticationManager
...
Renamed OidcReactiveAuthenticationManager to
OidcAuthorizationCodeReactiveAuthenticationManager since it only handles
authorization code flow.
Fixes: gh-5530
2018-07-26 15:14:11 -05:00
7b2b1a877d
Default RequestCache as @Bean
...
Fixes: gh-5583
2018-07-26 15:14:11 -05:00
8ce244f5d2
Simplify Configuring RequestCache
...
Now the RequestCache is configured on any default success handler.
Fixes: gh-5582
2018-07-26 15:14:11 -05:00
6012bfdc6e
Rename FormLoginConfigurerTests to FormLoginConfigurerSpec
...
Rename so can add new Java based tests for gh-5582
Issue: gh-5582
2018-07-26 15:14:11 -05:00
fc5083ae0c
Bearer Token Exception Handling Configuration
...
This exposes #authenticationEntryPoint(), #accessDeniedHandler, on
the Resource Server DSL.
With these, a user can customize the error responses when a bearer
token request fails.
Fixes: gh-5497
2018-07-24 12:49:26 -06:00
Joe Grandja
Robbie Martinus
Ankur Pathak
ir73
Dongmin Shin
Daniel Bustamante Ospina
Eric Deandrea
Josh Cummings
Karl Goffin
Erik van Paassen
Bob Maertz
Brian Demers
Rob Winch
Vedran Pavic
artsiom
Johnny Lim
Sola
Daniel Meier