Skip to content

Commit 67305ab

Browse files
jgrandjajgrandja
committed
Merge branch 0.4.x into main
The following commits are merged using the default merge strategy. 7e03795 Remove issuer setting from samples 2c4bd29 Add logging for authentication providers 74fe63a Add logging for authentication filters
2 parents f66e619 + 74fe63a commit 67305ab

24 files changed

+400
-3
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/ClientSecretAuthenticationProvider.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717

1818
import java.time.Instant;
1919

20+
import org.apache.commons.logging.Log;
21+
import org.apache.commons.logging.LogFactory;
22+
2023
import org.springframework.security.authentication.AuthenticationProvider;
2124
import org.springframework.security.core.Authentication;
2225
import org.springframework.security.core.AuthenticationException;
@@ -47,6 +50,7 @@
4750
*/
4851
public final class ClientSecretAuthenticationProvider implements AuthenticationProvider {
4952
private static final String ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1";
53+
private final Log logger = LogFactory.getLog(getClass());
5054
private final RegisteredClientRepository registeredClientRepository;
5155
private final CodeVerifierAuthenticator codeVerifierAuthenticator;
5256
private PasswordEncoder passwordEncoder;
@@ -95,6 +99,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
9599
throwInvalidClient(OAuth2ParameterNames.CLIENT_ID);
96100
}
97101

102+
if (this.logger.isTraceEnabled()) {
103+
this.logger.trace("Retrieved registered client");
104+
}
105+
98106
if (!registeredClient.getClientAuthenticationMethods().contains(
99107
clientAuthentication.getClientAuthenticationMethod())) {
100108
throwInvalidClient("authentication_method");
@@ -114,9 +122,17 @@ public Authentication authenticate(Authentication authentication) throws Authent
114122
throwInvalidClient("client_secret_expires_at");
115123
}
116124

125+
if (this.logger.isTraceEnabled()) {
126+
this.logger.trace("Validated client authentication parameters");
127+
}
128+
117129
// Validate the "code_verifier" parameter for the confidential client, if available
118130
this.codeVerifierAuthenticator.authenticateIfAvailable(clientAuthentication, registeredClient);
119131

132+
if (this.logger.isTraceEnabled()) {
133+
this.logger.trace("Authenticated client secret");
134+
}
135+
120136
return new OAuth2ClientAuthenticationToken(registeredClient,
121137
clientAuthentication.getClientAuthenticationMethod(), clientAuthentication.getCredentials());
122138
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/CodeVerifierAuthenticator.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@
2121
import java.util.Base64;
2222
import java.util.Map;
2323

24+
import org.apache.commons.logging.Log;
25+
import org.apache.commons.logging.LogFactory;
26+
2427
import org.springframework.security.oauth2.core.AuthorizationGrantType;
2528
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
2629
import org.springframework.security.oauth2.core.OAuth2Error;
@@ -47,6 +50,7 @@
4750
*/
4851
final class CodeVerifierAuthenticator {
4952
private static final OAuth2TokenType AUTHORIZATION_CODE_TOKEN_TYPE = new OAuth2TokenType(OAuth2ParameterNames.CODE);
53+
private final Log logger = LogFactory.getLog(getClass());
5054
private final OAuth2AuthorizationService authorizationService;
5155

5256
CodeVerifierAuthenticator(OAuth2AuthorizationService authorizationService) {
@@ -81,6 +85,10 @@ private boolean authenticate(OAuth2ClientAuthenticationToken clientAuthenticatio
8185
throwInvalidGrant(OAuth2ParameterNames.CODE);
8286
}
8387

88+
if (this.logger.isTraceEnabled()) {
89+
this.logger.trace("Retrieved authorization with authorization code");
90+
}
91+
8492
OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute(
8593
OAuth2AuthorizationRequest.class.getName());
8694

@@ -90,17 +98,28 @@ private boolean authenticate(OAuth2ClientAuthenticationToken clientAuthenticatio
9098
if (registeredClient.getClientSettings().isRequireProofKey()) {
9199
throwInvalidGrant(PkceParameterNames.CODE_CHALLENGE);
92100
} else {
101+
if (this.logger.isTraceEnabled()) {
102+
this.logger.trace("Did not authenticate code verifier since requireProofKey=false");
103+
}
93104
return false;
94105
}
95106
}
96107

108+
if (this.logger.isTraceEnabled()) {
109+
this.logger.trace("Validated code verifier parameters");
110+
}
111+
97112
String codeChallengeMethod = (String) authorizationRequest.getAdditionalParameters()
98113
.get(PkceParameterNames.CODE_CHALLENGE_METHOD);
99114
String codeVerifier = (String) parameters.get(PkceParameterNames.CODE_VERIFIER);
100115
if (!codeVerifierValid(codeVerifier, codeChallenge, codeChallengeMethod)) {
101116
throwInvalidGrant(PkceParameterNames.CODE_VERIFIER);
102117
}
103118

119+
if (this.logger.isTraceEnabled()) {
120+
this.logger.trace("Authenticated code verifier");
121+
}
122+
104123
return true;
105124
}
106125

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/JwtClientAssertionAuthenticationProvider.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@
1515
*/
1616
package org.springframework.security.oauth2.server.authorization.authentication;
1717

18+
import org.apache.commons.logging.Log;
19+
import org.apache.commons.logging.LogFactory;
20+
1821
import org.springframework.security.authentication.AuthenticationProvider;
1922
import org.springframework.security.core.Authentication;
2023
import org.springframework.security.core.AuthenticationException;
@@ -50,6 +53,7 @@ public final class JwtClientAssertionAuthenticationProvider implements Authentic
5053
private static final String ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1";
5154
private static final ClientAuthenticationMethod JWT_CLIENT_ASSERTION_AUTHENTICATION_METHOD =
5255
new ClientAuthenticationMethod("urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
56+
private final Log logger = LogFactory.getLog(getClass());
5357
private final RegisteredClientRepository registeredClientRepository;
5458
private final CodeVerifierAuthenticator codeVerifierAuthenticator;
5559
private JwtDecoderFactory<RegisteredClient> jwtDecoderFactory;
@@ -84,6 +88,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
8488
throwInvalidClient(OAuth2ParameterNames.CLIENT_ID);
8589
}
8690

91+
if (this.logger.isTraceEnabled()) {
92+
this.logger.trace("Retrieved registered client");
93+
}
94+
8795
if (!registeredClient.getClientAuthenticationMethods().contains(ClientAuthenticationMethod.PRIVATE_KEY_JWT) &&
8896
!registeredClient.getClientAuthenticationMethods().contains(ClientAuthenticationMethod.CLIENT_SECRET_JWT)) {
8997
throwInvalidClient("authentication_method");
@@ -101,6 +109,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
101109
throwInvalidClient(OAuth2ParameterNames.CLIENT_ASSERTION, ex);
102110
}
103111

112+
if (this.logger.isTraceEnabled()) {
113+
this.logger.trace("Validated client authentication parameters");
114+
}
115+
104116
// Validate the "code_verifier" parameter for the confidential client, if available
105117
this.codeVerifierAuthenticator.authenticateIfAvailable(clientAuthentication, registeredClient);
106118

@@ -109,6 +121,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
109121
ClientAuthenticationMethod.PRIVATE_KEY_JWT :
110122
ClientAuthenticationMethod.CLIENT_SECRET_JWT;
111123

124+
if (this.logger.isTraceEnabled()) {
125+
this.logger.trace("Authenticated client assertion");
126+
}
127+
112128
return new OAuth2ClientAuthenticationToken(registeredClient, clientAuthenticationMethod, jwtAssertion);
113129
}
114130

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@
2020
import java.util.HashMap;
2121
import java.util.Map;
2222

23+
import org.apache.commons.logging.Log;
24+
import org.apache.commons.logging.LogFactory;
25+
26+
import org.springframework.core.log.LogMessage;
2327
import org.springframework.security.authentication.AuthenticationProvider;
2428
import org.springframework.security.core.Authentication;
2529
import org.springframework.security.core.AuthenticationException;
@@ -72,6 +76,7 @@ public final class OAuth2AuthorizationCodeAuthenticationProvider implements Auth
7276
new OAuth2TokenType(OAuth2ParameterNames.CODE);
7377
private static final OAuth2TokenType ID_TOKEN_TOKEN_TYPE =
7478
new OAuth2TokenType(OidcParameterNames.ID_TOKEN);
79+
private final Log logger = LogFactory.getLog(getClass());
7580
private final OAuth2AuthorizationService authorizationService;
7681
private final OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator;
7782

@@ -99,11 +104,20 @@ public Authentication authenticate(Authentication authentication) throws Authent
99104
getAuthenticatedClientElseThrowInvalidClient(authorizationCodeAuthentication);
100105
RegisteredClient registeredClient = clientPrincipal.getRegisteredClient();
101106

107+
if (this.logger.isTraceEnabled()) {
108+
this.logger.trace("Retrieved registered client");
109+
}
110+
102111
OAuth2Authorization authorization = this.authorizationService.findByToken(
103112
authorizationCodeAuthentication.getCode(), AUTHORIZATION_CODE_TOKEN_TYPE);
104113
if (authorization == null) {
105114
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
106115
}
116+
117+
if (this.logger.isTraceEnabled()) {
118+
this.logger.trace("Retrieved authorization with authorization code");
119+
}
120+
107121
OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode =
108122
authorization.getToken(OAuth2AuthorizationCode.class);
109123

@@ -115,6 +129,9 @@ public Authentication authenticate(Authentication authentication) throws Authent
115129
// Invalidate the authorization code given that a different client is attempting to use it
116130
authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, authorizationCode.getToken());
117131
this.authorizationService.save(authorization);
132+
if (this.logger.isWarnEnabled()) {
133+
this.logger.warn(LogMessage.format("Invalidated authorization code used by registered client '%s'", registeredClient.getId()));
134+
}
118135
}
119136
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
120137
}
@@ -128,6 +145,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
128145
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
129146
}
130147

148+
if (this.logger.isTraceEnabled()) {
149+
this.logger.trace("Validated token request parameters");
150+
}
151+
131152
// @formatter:off
132153
DefaultOAuth2TokenContext.Builder tokenContextBuilder = DefaultOAuth2TokenContext.builder()
133154
.registeredClient(registeredClient)
@@ -149,6 +170,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
149170
"The token generator failed to generate the access token.", ERROR_URI);
150171
throw new OAuth2AuthenticationException(error);
151172
}
173+
174+
if (this.logger.isTraceEnabled()) {
175+
this.logger.trace("Generated access token");
176+
}
177+
152178
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
153179
generatedAccessToken.getTokenValue(), generatedAccessToken.getIssuedAt(),
154180
generatedAccessToken.getExpiresAt(), tokenContext.getAuthorizedScopes());
@@ -172,6 +198,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
172198
"The token generator failed to generate the refresh token.", ERROR_URI);
173199
throw new OAuth2AuthenticationException(error);
174200
}
201+
202+
if (this.logger.isTraceEnabled()) {
203+
this.logger.trace("Generated refresh token");
204+
}
205+
175206
refreshToken = (OAuth2RefreshToken) generatedRefreshToken;
176207
authorizationBuilder.refreshToken(refreshToken);
177208
}
@@ -191,6 +222,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
191222
"The token generator failed to generate the ID token.", ERROR_URI);
192223
throw new OAuth2AuthenticationException(error);
193224
}
225+
226+
if (this.logger.isTraceEnabled()) {
227+
this.logger.trace("Generated id token");
228+
}
229+
194230
idToken = new OidcIdToken(generatedIdToken.getTokenValue(), generatedIdToken.getIssuedAt(),
195231
generatedIdToken.getExpiresAt(), ((Jwt) generatedIdToken).getClaims());
196232
authorizationBuilder.token(idToken, (metadata) ->
@@ -206,12 +242,20 @@ public Authentication authenticate(Authentication authentication) throws Authent
206242

207243
this.authorizationService.save(authorization);
208244

245+
if (this.logger.isTraceEnabled()) {
246+
this.logger.trace("Saved authorization");
247+
}
248+
209249
Map<String, Object> additionalParameters = Collections.emptyMap();
210250
if (idToken != null) {
211251
additionalParameters = new HashMap<>();
212252
additionalParameters.put(OidcParameterNames.ID_TOKEN, idToken.getTokenValue());
213253
}
214254

255+
if (this.logger.isTraceEnabled()) {
256+
this.logger.trace("Authenticated token request");
257+
}
258+
215259
return new OAuth2AccessTokenAuthenticationToken(
216260
registeredClient, clientPrincipal, accessToken, refreshToken, additionalParameters);
217261
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
import java.util.Set;
2121
import java.util.function.Consumer;
2222

23+
import org.apache.commons.logging.Log;
24+
import org.apache.commons.logging.LogFactory;
25+
2326
import org.springframework.security.authentication.AnonymousAuthenticationToken;
2427
import org.springframework.security.authentication.AuthenticationProvider;
2528
import org.springframework.security.core.Authentication;
@@ -69,6 +72,7 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen
6972
private static final String PKCE_ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc7636#section-4.4.1";
7073
private static final StringKeyGenerator DEFAULT_STATE_GENERATOR =
7174
new Base64StringKeyGenerator(Base64.getUrlEncoder());
75+
private final Log logger = LogFactory.getLog(getClass());
7276
private final RegisteredClientRepository registeredClientRepository;
7377
private final OAuth2AuthorizationService authorizationService;
7478
private final OAuth2AuthorizationConsentService authorizationConsentService;
@@ -105,6 +109,10 @@ public Authentication authenticate(Authentication authentication) throws Authent
105109
authorizationCodeRequestAuthentication, null);
106110
}
107111

112+
if (this.logger.isTraceEnabled()) {
113+
this.logger.trace("Retrieved registered client");
114+
}
115+
108116
OAuth2AuthorizationCodeRequestAuthenticationContext authenticationContext =
109117
OAuth2AuthorizationCodeRequestAuthenticationContext.with(authorizationCodeRequestAuthentication)
110118
.registeredClient(registeredClient)
@@ -129,12 +137,19 @@ public Authentication authenticate(Authentication authentication) throws Authent
129137
authorizationCodeRequestAuthentication, registeredClient, null);
130138
}
131139

140+
if (this.logger.isTraceEnabled()) {
141+
this.logger.trace("Validated authorization code request parameters");
142+
}
143+
132144
// ---------------
133145
// The request is valid - ensure the resource owner is authenticated
134146
// ---------------
135147

136148
Authentication principal = (Authentication) authorizationCodeRequestAuthentication.getPrincipal();
137149
if (!isPrincipalAuthenticated(principal)) {
150+
if (this.logger.isTraceEnabled()) {
151+
this.logger.trace("Did not authenticate authorization code request since principal not authenticated");
152+
}
138153
// Return the authorization request as-is where isAuthenticated() is false
139154
return authorizationCodeRequestAuthentication;
140155
}
@@ -156,11 +171,20 @@ public Authentication authenticate(Authentication authentication) throws Authent
156171
OAuth2Authorization authorization = authorizationBuilder(registeredClient, principal, authorizationRequest)
157172
.attribute(OAuth2ParameterNames.STATE, state)
158173
.build();
174+
175+
if (this.logger.isTraceEnabled()) {
176+
logger.trace("Generated authorization consent state");
177+
}
178+
159179
this.authorizationService.save(authorization);
160180

161181
Set<String> currentAuthorizedScopes = currentAuthorizationConsent != null ?
162182
currentAuthorizationConsent.getScopes() : null;
163183

184+
if (this.logger.isTraceEnabled()) {
185+
this.logger.trace("Saved authorization");
186+
}
187+
164188
return new OAuth2AuthorizationConsentAuthenticationToken(authorizationRequest.getAuthorizationUri(),
165189
registeredClient.getClientId(), principal, state, currentAuthorizedScopes, null);
166190
}
@@ -174,17 +198,29 @@ public Authentication authenticate(Authentication authentication) throws Authent
174198
throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);
175199
}
176200

201+
if (this.logger.isTraceEnabled()) {
202+
this.logger.trace("Generated authorization code");
203+
}
204+
177205
OAuth2Authorization authorization = authorizationBuilder(registeredClient, principal, authorizationRequest)
178206
.authorizedScopes(authorizationRequest.getScopes())
179207
.token(authorizationCode)
180208
.build();
181209
this.authorizationService.save(authorization);
182210

211+
if (this.logger.isTraceEnabled()) {
212+
this.logger.trace("Saved authorization");
213+
}
214+
183215
String redirectUri = authorizationRequest.getRedirectUri();
184216
if (!StringUtils.hasText(redirectUri)) {
185217
redirectUri = registeredClient.getRedirectUris().iterator().next();
186218
}
187219

220+
if (this.logger.isTraceEnabled()) {
221+
this.logger.trace("Authenticated authorization code request");
222+
}
223+
188224
return new OAuth2AuthorizationCodeRequestAuthenticationToken(authorizationRequest.getAuthorizationUri(),
189225
registeredClient.getClientId(), principal, authorizationCode, redirectUri,
190226
authorizationRequest.getState(), authorizationRequest.getScopes());

0 commit comments

Comments
 (0)