Skip to content

Commit 1783bf7

Browse files
jgrandjajgrandja
committed
Polish gh-1013 
1 parent 9767d1e commit 1783bf7

File tree

6 files changed

+60
-33
lines changed

6 files changed

+60
-33
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -350,9 +350,11 @@ private static void throwError(OAuth2Error error, String parameterName,
350350
throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, authorizationCodeRequestAuthenticationResult);
351351
}
352352

353-
private static String resolveRedirectUri(OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication,
353+
private static String resolveRedirectUri(
354+
OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication,
354355
OAuth2AuthorizationRequest authorizationRequest, RegisteredClient registeredClient) {
355-
if (authorizationCodeRequestAuthentication!=null && StringUtils.hasText(authorizationCodeRequestAuthentication.getRedirectUri())){
356+
357+
if (authorizationCodeRequestAuthentication != null && StringUtils.hasText(authorizationCodeRequestAuthentication.getRedirectUri())) {
356358
return authorizationCodeRequestAuthentication.getRedirectUri();
357359
}
358360
if (authorizationRequest != null && StringUtils.hasText(authorizationRequest.getRedirectUri())) {

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProviderTests.java‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -132,10 +132,11 @@ public void setAuthenticationValidatorWhenNullThenThrowIllegalArgumentException(
132132
@Test
133133
public void authenticateWhenInvalidClientIdThenThrowOAuth2AuthorizationCodeRequestAuthenticationException() {
134134
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
135+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[1];
135136
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
136137
new OAuth2AuthorizationCodeRequestAuthenticationToken(
137138
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
138-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
139+
redirectUri, STATE, registeredClient.getScopes(), null);
139140
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
140141
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
141142
.satisfies(ex ->
@@ -301,10 +302,11 @@ public void authenticateWhenClientNotAuthorizedToRequestCodeThenThrowOAuth2Autho
301302
.build();
302303
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
303304
.thenReturn(registeredClient);
305+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[1];
304306
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
305307
new OAuth2AuthorizationCodeRequestAuthenticationToken(
306308
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
307-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
309+
redirectUri, STATE, registeredClient.getScopes(), null);
308310
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
309311
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
310312
.satisfies(ex ->
@@ -319,10 +321,11 @@ public void authenticateWhenInvalidScopeThenThrowOAuth2AuthorizationCodeRequestA
319321
.build();
320322
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
321323
.thenReturn(registeredClient);
324+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[2];
322325
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
323326
new OAuth2AuthorizationCodeRequestAuthenticationToken(
324327
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
325-
registeredClient.getRedirectUris().iterator().next(), STATE,
328+
redirectUri, STATE,
326329
Collections.singleton("invalid-scope"), null);
327330
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
328331
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
@@ -339,10 +342,11 @@ public void authenticateWhenPkceRequiredAndMissingCodeChallengeThenThrowOAuth2Au
339342
.build();
340343
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
341344
.thenReturn(registeredClient);
345+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[2];
342346
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
343347
new OAuth2AuthorizationCodeRequestAuthenticationToken(
344348
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
345-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
349+
redirectUri, STATE, registeredClient.getScopes(), null);
346350
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
347351
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
348352
.satisfies(ex ->
@@ -356,13 +360,14 @@ public void authenticateWhenPkceUnsupportedCodeChallengeMethodThenThrowOAuth2Aut
356360
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
357361
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
358362
.thenReturn(registeredClient);
363+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[0];
359364
Map<String, Object> additionalParameters = new HashMap<>();
360365
additionalParameters.put(PkceParameterNames.CODE_CHALLENGE, "code-challenge");
361366
additionalParameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "unsupported");
362367
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
363368
new OAuth2AuthorizationCodeRequestAuthenticationToken(
364369
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
365-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), additionalParameters);
370+
redirectUri, STATE, registeredClient.getScopes(), additionalParameters);
366371
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
367372
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
368373
.satisfies(ex ->
@@ -377,12 +382,13 @@ public void authenticateWhenPkceMissingCodeChallengeMethodThenThrowOAuth2Authori
377382
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
378383
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
379384
.thenReturn(registeredClient);
385+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[2];
380386
Map<String, Object> additionalParameters = new HashMap<>();
381387
additionalParameters.put(PkceParameterNames.CODE_CHALLENGE, "code-challenge");
382388
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
383389
new OAuth2AuthorizationCodeRequestAuthenticationToken(
384390
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
385-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), additionalParameters);
391+
redirectUri, STATE, registeredClient.getScopes(), additionalParameters);
386392
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
387393
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
388394
.satisfies(ex ->
@@ -398,10 +404,11 @@ public void authenticateWhenPrincipalNotAuthenticatedThenReturnAuthorizationCode
398404
.thenReturn(registeredClient);
399405
this.principal.setAuthenticated(false);
400406

407+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[1];
401408
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
402409
new OAuth2AuthorizationCodeRequestAuthenticationToken(
403410
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
404-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
411+
redirectUri, STATE, registeredClient.getScopes(), null);
405412

406413
OAuth2AuthorizationCodeRequestAuthenticationToken authenticationResult =
407414
(OAuth2AuthorizationCodeRequestAuthenticationToken) this.authenticationProvider.authenticate(authentication);
@@ -418,10 +425,11 @@ public void authenticateWhenRequireAuthorizationConsentThenReturnAuthorizationCo
418425
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
419426
.thenReturn(registeredClient);
420427

428+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[0];
421429
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
422430
new OAuth2AuthorizationCodeRequestAuthenticationToken(
423431
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
424-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
432+
redirectUri, STATE, registeredClient.getScopes(), null);
425433

426434
OAuth2AuthorizationConsentAuthenticationToken authenticationResult =
427435
(OAuth2AuthorizationConsentAuthenticationToken) this.authenticationProvider.authenticate(authentication);
@@ -468,10 +476,11 @@ public void authenticateWhenRequireAuthorizationConsentAndOnlyOpenidScopeRequest
468476
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
469477
.thenReturn(registeredClient);
470478

479+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[1];
471480
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
472481
new OAuth2AuthorizationCodeRequestAuthenticationToken(
473482
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
474-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
483+
redirectUri, STATE, registeredClient.getScopes(), null);
475484

476485
OAuth2AuthorizationCodeRequestAuthenticationToken authenticationResult =
477486
(OAuth2AuthorizationCodeRequestAuthenticationToken) this.authenticationProvider.authenticate(authentication);
@@ -494,10 +503,11 @@ public void authenticateWhenRequireAuthorizationConsentAndAllPreviouslyApprovedT
494503
when(this.authorizationConsentService.findById(eq(registeredClient.getId()), eq(this.principal.getName())))
495504
.thenReturn(previousAuthorizationConsent);
496505

506+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[2];
497507
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
498508
new OAuth2AuthorizationCodeRequestAuthenticationToken(
499509
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
500-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
510+
redirectUri, STATE, registeredClient.getScopes(), null);
501511

502512
OAuth2AuthorizationCodeRequestAuthenticationToken authenticationResult =
503513
(OAuth2AuthorizationCodeRequestAuthenticationToken) this.authenticationProvider.authenticate(authentication);
@@ -511,13 +521,14 @@ public void authenticateWhenAuthorizationCodeRequestValidThenReturnAuthorization
511521
when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId())))
512522
.thenReturn(registeredClient);
513523

524+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[0];
514525
Map<String, Object> additionalParameters = new HashMap<>();
515526
additionalParameters.put(PkceParameterNames.CODE_CHALLENGE, "code-challenge");
516527
additionalParameters.put(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256");
517528
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
518529
new OAuth2AuthorizationCodeRequestAuthenticationToken(
519530
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
520-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), additionalParameters);
531+
redirectUri, STATE, registeredClient.getScopes(), additionalParameters);
521532

522533
OAuth2AuthorizationCodeRequestAuthenticationToken authenticationResult =
523534
(OAuth2AuthorizationCodeRequestAuthenticationToken) this.authenticationProvider.authenticate(authentication);
@@ -535,10 +546,11 @@ public void authenticateWhenAuthorizationCodeNotGeneratedThenThrowOAuth2Authoriz
535546
OAuth2TokenGenerator<OAuth2AuthorizationCode> authorizationCodeGenerator = mock(OAuth2TokenGenerator.class);
536547
this.authenticationProvider.setAuthorizationCodeGenerator(authorizationCodeGenerator);
537548

549+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[1];
538550
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
539551
new OAuth2AuthorizationCodeRequestAuthenticationToken(
540552
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
541-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
553+
redirectUri, STATE, registeredClient.getScopes(), null);
542554

543555
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
544556
.isInstanceOf(OAuth2AuthorizationCodeRequestAuthenticationException.class)
@@ -559,10 +571,11 @@ public void authenticateWhenCustomAuthenticationValidatorThenUsed() {
559571
Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authenticationValidator = mock(Consumer.class);
560572
this.authenticationProvider.setAuthenticationValidator(authenticationValidator);
561573

574+
String redirectUri = registeredClient.getRedirectUris().toArray(new String[0])[2];
562575
OAuth2AuthorizationCodeRequestAuthenticationToken authentication =
563576
new OAuth2AuthorizationCodeRequestAuthenticationToken(
564577
AUTHORIZATION_URI, registeredClient.getClientId(), principal,
565-
registeredClient.getRedirectUris().iterator().next(), STATE, registeredClient.getScopes(), null);
578+
redirectUri, STATE, registeredClient.getScopes(), null);
566579

567580
OAuth2AuthorizationCodeRequestAuthenticationToken authenticationResult =
568581
(OAuth2AuthorizationCodeRequestAuthenticationToken) this.authenticationProvider.authenticate(authentication);

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/client/TestRegisteredClients.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,7 +35,9 @@ public static RegisteredClient.Builder registeredClient() {
3535
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
3636
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
3737
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
38-
.redirectUri("https://example.com")
38+
.redirectUri("https://example.com/callback-1")
39+
.redirectUri("https://example.com/callback-2")
40+
.redirectUri("https://example.com/callback-3")
3941
.scope("scope1");
4042
}
4143

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationCodeGrantTests.java‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -289,13 +289,15 @@ private void assertAuthorizationRequestRedirectsToClient(String authorizationEnd
289289
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
290290
this.registeredClientRepository.save(registeredClient);
291291

292+
MultiValueMap<String, String> authorizationRequestParameters = getAuthorizationRequestParameters(registeredClient);
292293
MvcResult mvcResult = this.mvc.perform(get(authorizationEndpointUri)
293-
.params(getAuthorizationRequestParameters(registeredClient))
294+
.params(authorizationRequestParameters)
294295
.with(user("user")))
295296
.andExpect(status().is3xxRedirection())
296297
.andReturn();
297298
String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
298-
assertThat(redirectedUrl).matches("https://example.com\\?code=.{15,}&state=" + STATE_URL_ENCODED);
299+
String expectedRedirectUri = authorizationRequestParameters.getFirst(OAuth2ParameterNames.REDIRECT_URI);
300+
assertThat(redirectedUrl).matches(expectedRedirectUri + "\\?code=.{15,}&state=" + STATE_URL_ENCODED);
299301

300302
String authorizationCode = extractParameterFromRedirectUri(redirectedUrl, "code");
301303
OAuth2Authorization authorization = this.authorizationService.findByToken(authorizationCode, AUTHORIZATION_CODE_TOKEN_TYPE);
@@ -423,15 +425,17 @@ public void requestWhenConfidentialClientWithPkceAndMissingCodeVerifierThenBadRe
423425
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
424426
this.registeredClientRepository.save(registeredClient);
425427

428+
MultiValueMap<String, String> authorizationRequestParameters = getAuthorizationRequestParameters(registeredClient);
426429
MvcResult mvcResult = this.mvc.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI)
427-
.params(getAuthorizationRequestParameters(registeredClient))
430+
.params(authorizationRequestParameters)
428431
.param(PkceParameterNames.CODE_CHALLENGE, S256_CODE_CHALLENGE)
429432
.param(PkceParameterNames.CODE_CHALLENGE_METHOD, "S256")
430433
.with(user("user")))
431434
.andExpect(status().is3xxRedirection())
432435
.andReturn();
433436
String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
434-
assertThat(redirectedUrl).matches("https://example.com\\?code=.{15,}&state=" + STATE_URL_ENCODED);
437+
String expectedRedirectUri = authorizationRequestParameters.getFirst(OAuth2ParameterNames.REDIRECT_URI);
438+
assertThat(redirectedUrl).matches(expectedRedirectUri + "\\?code=.{15,}&state=" + STATE_URL_ENCODED);
435439

436440
String authorizationCode = extractParameterFromRedirectUri(redirectedUrl, "code");
437441
OAuth2Authorization authorizationCodeAuthorization = this.authorizationService.findByToken(authorizationCode, AUTHORIZATION_CODE_TOKEN_TYPE);
@@ -527,7 +531,7 @@ public void requestWhenConsentRequestThenReturnAccessTokenResponse() throws Exce
527531
.andReturn();
528532

529533
String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
530-
assertThat(redirectedUrl).matches("https://example.com\\?code=.{15,}&state=" + STATE_URL_ENCODED);
534+
assertThat(redirectedUrl).matches(authorizationRequest.getRedirectUri() + "\\?code=.{15,}&state=" + STATE_URL_ENCODED);
531535

532536
String authorizationCode = extractParameterFromRedirectUri(redirectedUrl, "code");
533537
OAuth2Authorization authorizationCodeAuthorization = this.authorizationService.findByToken(authorizationCode, AUTHORIZATION_CODE_TOKEN_TYPE);
@@ -614,7 +618,7 @@ public void requestWhenCustomConsentCustomizerConfiguredThenUsed() throws Except
614618
.andReturn();
615619

616620
String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
617-
assertThat(redirectedUrl).matches("https://example.com\\?code=.{15,}&state=" + STATE_URL_ENCODED);
621+
assertThat(redirectedUrl).matches(authorizationRequest.getRedirectUri() + "\\?code=.{15,}&state=" + STATE_URL_ENCODED);
618622

619623
String authorizationCode = extractParameterFromRedirectUri(redirectedUrl, "code");
620624
OAuth2Authorization authorizationCodeAuthorization = this.authorizationService.findByToken(authorizationCode, AUTHORIZATION_CODE_TOKEN_TYPE);

0 commit comments

Comments
 (0)