Skip to content

Commit 410d69e

Browse files
jgrandjajgrandja
committed
Merge branch 0.4.x into main
The following commits are merged using the default merge strategy. d7aa72a Disable OpenID Connect 1.0 by default 9c964e3 Update reference for customizing Authorization Server metadata response
2 parents 2ba7bba + 9c964e3 commit 410d69e

File tree

12 files changed

+179
-42
lines changed

12 files changed

+179
-42
lines changed

‎docs/src/docs/asciidoc/configuration-model.adoc‎

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,10 @@ The OAuth2 authorization server `SecurityFilterChain` `@Bean` is configured with
1919
* xref:protocol-endpoints.adoc#oauth2-token-revocation-endpoint[OAuth2 Token Revocation endpoint]
2020
* xref:protocol-endpoints.adoc#oauth2-authorization-server-metadata-endpoint[OAuth2 Authorization Server Metadata endpoint]
2121
* xref:protocol-endpoints.adoc#jwk-set-endpoint[JWK Set endpoint]
22-
* xref:protocol-endpoints.adoc#oidc-provider-configuration-endpoint[OpenID Connect 1.0 Provider Configuration endpoint]
23-
* xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo endpoint]
2422

2523
[NOTE]
2624
The JWK Set endpoint is configured *only* if a `JWKSource<SecurityContext>` `@Bean` is registered.
2725

28-
[NOTE]
29-
The xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration endpoint] is disabled by default because many deployments do not require dynamic client registration.
30-
3126
The following example shows how to use `OAuth2AuthorizationServerConfiguration` to apply the minimal default configuration:
3227

3328
[source,java]
@@ -55,6 +50,29 @@ public class AuthorizationServerConfig {
5550
[IMPORTANT]
5651
The https://datatracker.ietf.org/doc/html/rfc6749#section-4.1[authorization_code grant] requires the resource owner to be authenticated. Therefore, a user authentication mechanism *must* be configured in addition to the default OAuth2 security configuration.
5752

53+
https://openid.net/specs/openid-connect-core-1_0.html[OpenID Connect 1.0] is disabled in the default configuration. The following example shows how to enable OpenID Connect 1.0 by initializing the `OidcConfigurer`:
54+
55+
[source,java]
56+
----
57+
@Bean
58+
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
59+
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
60+
61+
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
62+
.oidc(Customizer.withDefaults()); // Initialize `OidcConfigurer`
63+
64+
return http.build();
65+
}
66+
----
67+
68+
In addition to the default protocol endpoints, the OAuth2 authorization server `SecurityFilterChain` `@Bean` is configured with the following OpenID Connect 1.0 protocol endpoints:
69+
70+
* xref:protocol-endpoints.adoc#oidc-provider-configuration-endpoint[OpenID Connect 1.0 Provider Configuration endpoint]
71+
* xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo endpoint]
72+
73+
[NOTE]
74+
The xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration endpoint] is disabled by default because many deployments do not require dynamic client registration.
75+
5876
[TIP]
5977
`OAuth2AuthorizationServerConfiguration.jwtDecoder(JWKSource<SecurityContext>)` is a convenience (`static`) utility method that can be used to register a `JwtDecoder` `@Bean`, which is *REQUIRED* for the xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo endpoint] and the xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration endpoint].
6078

@@ -98,9 +116,11 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
98116
.tokenEndpoint(tokenEndpoint -> { }) <8>
99117
.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint -> { }) <9>
100118
.tokenRevocationEndpoint(tokenRevocationEndpoint -> { }) <10>
119+
.authorizationServerMetadataEndpoint(authorizationServerMetadataEndpoint -> { }) <11>
101120
.oidc(oidc -> oidc
102-
.userInfoEndpoint(userInfoEndpoint -> { }) <11>
103-
.clientRegistrationEndpoint(clientRegistrationEndpoint -> { }) <12>
121+
.providerConfigurationEndpoint(providerConfigurationEndpoint -> { }) <12>
122+
.userInfoEndpoint(userInfoEndpoint -> { }) <13>
123+
.clientRegistrationEndpoint(clientRegistrationEndpoint -> { }) <14>
104124
);
105125
106126
return http.build();
@@ -116,8 +136,10 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
116136
<8> `tokenEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oauth2-token-endpoint[OAuth2 Token endpoint].
117137
<9> `tokenIntrospectionEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oauth2-token-introspection-endpoint[OAuth2 Token Introspection endpoint].
118138
<10> `tokenRevocationEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oauth2-token-revocation-endpoint[OAuth2 Token Revocation endpoint].
119-
<11> `userInfoEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo endpoint].
120-
<12> `clientRegistrationEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration endpoint].
139+
<11> `authorizationServerMetadataEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oauth2-authorization-server-metadata-endpoint[OAuth2 Authorization Server Metadata endpoint].
140+
<12> `providerConfigurationEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oidc-provider-configuration-endpoint[OpenID Connect 1.0 Provider Configuration endpoint].
141+
<13> `userInfoEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo endpoint].
142+
<14> `clientRegistrationEndpoint()`: The configurer for the xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration endpoint].
121143

122144
[[configuring-authorization-server-settings]]
123145
== Configuring Authorization Server Settings

‎docs/src/docs/asciidoc/examples/src/main/java/sample/gettingStarted/SecurityConfig.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4343
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
4444
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
45+
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
4546
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
4647
import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
4748
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -56,6 +57,8 @@ public class SecurityConfig {
5657
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
5758
throws Exception {
5859
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
60+
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
61+
.oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0
5962
// @formatter:off
6063
http
6164
// Redirect to the login page when not authenticated from the

‎docs/src/docs/asciidoc/examples/src/main/java/sample/userinfo/EnableUserInfoSecurityConfig.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4545
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
4646
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
47+
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
4748
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
4849
import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
4950
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -57,6 +58,8 @@ public class EnableUserInfoSecurityConfig {
5758
@Order(1)
5859
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
5960
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
61+
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
62+
.oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0
6063
// @formatter:off
6164
http
6265
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) // <2>

‎docs/src/docs/asciidoc/examples/src/test/java/sample/jpa/JpaTests.java‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,12 @@
3636
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
3737
import org.springframework.context.annotation.Bean;
3838
import org.springframework.context.annotation.ComponentScan;
39-
import org.springframework.context.annotation.Import;
39+
import org.springframework.core.Ordered;
40+
import org.springframework.core.annotation.Order;
41+
import org.springframework.security.config.Customizer;
42+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4043
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
44+
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer;
4145
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
4246
import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames;
4347
import org.springframework.security.oauth2.jwt.JwtDecoder;
@@ -49,6 +53,10 @@
4953
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
5054
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
5155
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
56+
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
57+
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
58+
import org.springframework.security.web.SecurityFilterChain;
59+
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
5260
import org.springframework.test.web.servlet.MockMvc;
5361
import org.springframework.util.StringUtils;
5462

@@ -133,9 +141,25 @@ private OAuth2Authorization findAuthorization(String token, String tokenType) {
133141
@EnableWebSecurity
134142
@EnableAutoConfiguration
135143
@ComponentScan
136-
@Import(OAuth2AuthorizationServerConfiguration.class)
137144
static class AuthorizationServerConfig {
138145

146+
@Bean
147+
@Order(Ordered.HIGHEST_PRECEDENCE)
148+
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
149+
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
150+
http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
151+
.oidc(Customizer.withDefaults()); // Enable OpenID Connect 1.0
152+
153+
// @formatter:off
154+
http
155+
.exceptionHandling(exceptions ->
156+
exceptions.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))
157+
)
158+
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
159+
// @formatter:on
160+
return http.build();
161+
}
162+
139163
@Bean
140164
public JWKSource<SecurityContext> jwkSource() {
141165
JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
@@ -147,6 +171,11 @@ public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
147171
return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
148172
}
149173

174+
@Bean
175+
public AuthorizationServerSettings authorizationServerSettings() {
176+
return AuthorizationServerSettings.builder().build();
177+
}
178+
150179
}
151180

152181
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationEndpointConfigurer.java‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,11 @@
2828
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2929
import org.springframework.security.oauth2.core.OAuth2Error;
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationResponse;
31+
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationContext;
3132
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationException;
3233
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationProvider;
3334
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationToken;
35+
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationValidator;
3436
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationProvider;
3537
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationToken;
3638
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
@@ -65,6 +67,7 @@ public final class OAuth2AuthorizationEndpointConfigurer extends AbstractOAuth2C
6567
private AuthenticationSuccessHandler authorizationResponseHandler;
6668
private AuthenticationFailureHandler errorResponseHandler;
6769
private String consentPage;
70+
private Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authorizationCodeRequestAuthenticationValidator;
6871

6972
/**
7073
* Restrict for internal use only.
@@ -189,6 +192,14 @@ public OAuth2AuthorizationEndpointConfigurer consentPage(String consentPage) {
189192
return this;
190193
}
191194

195+
void addAuthorizationCodeRequestAuthenticationValidator(
196+
Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authenticationValidator) {
197+
this.authorizationCodeRequestAuthenticationValidator =
198+
this.authorizationCodeRequestAuthenticationValidator == null ?
199+
authenticationValidator :
200+
this.authorizationCodeRequestAuthenticationValidator.andThen(authenticationValidator);
201+
}
202+
192203
@Override
193204
void init(HttpSecurity httpSecurity) {
194205
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
@@ -251,14 +262,19 @@ private static List<AuthenticationConverter> createDefaultAuthenticationConverte
251262
return authenticationConverters;
252263
}
253264

254-
private static List<AuthenticationProvider> createDefaultAuthenticationProviders(HttpSecurity httpSecurity) {
265+
private List<AuthenticationProvider> createDefaultAuthenticationProviders(HttpSecurity httpSecurity) {
255266
List<AuthenticationProvider> authenticationProviders = new ArrayList<>();
256267

257268
OAuth2AuthorizationCodeRequestAuthenticationProvider authorizationCodeRequestAuthenticationProvider =
258269
new OAuth2AuthorizationCodeRequestAuthenticationProvider(
259270
OAuth2ConfigurerUtils.getRegisteredClientRepository(httpSecurity),
260271
OAuth2ConfigurerUtils.getAuthorizationService(httpSecurity),
261272
OAuth2ConfigurerUtils.getAuthorizationConsentService(httpSecurity));
273+
if (this.authorizationCodeRequestAuthenticationValidator != null) {
274+
authorizationCodeRequestAuthenticationProvider.setAuthenticationValidator(
275+
new OAuth2AuthorizationCodeRequestAuthenticationValidator()
276+
.andThen(this.authorizationCodeRequestAuthenticationValidator));
277+
}
262278
authenticationProviders.add(authorizationCodeRequestAuthenticationProvider);
263279

264280
OAuth2AuthorizationConsentAuthenticationProvider authorizationConsentAuthenticationProvider =

0 commit comments

Comments
 (0)