Skip to content

Commit 6ffda38

Browse files
jgrandjajgrandja
committed
OAuth2AccessToken.scopes includes authorized or requested scopes
Closes gh-224
1 parent 09846ee commit 6ffda38

File tree

6 files changed

+16
-10
lines changed

6 files changed

+16
-10
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
166166

167167
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
168168
jwtAccessToken.getTokenValue(), jwtAccessToken.getIssuedAt(),
169-
jwtAccessToken.getExpiresAt(), jwtAccessToken.getClaim(OAuth2ParameterNames.SCOPE));
169+
jwtAccessToken.getExpiresAt(), authorizedScopes);
170170

171171
OAuth2RefreshToken refreshToken = null;
172172
if (registeredClient.getAuthorizationGrantTypes().contains(AuthorizationGrantType.REFRESH_TOKEN)) {

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
import org.springframework.security.oauth2.core.OAuth2Error;
3030
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
3131
import org.springframework.security.oauth2.core.OAuth2TokenType;
32-
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
3332
import org.springframework.security.oauth2.jwt.JoseHeader;
3433
import org.springframework.security.oauth2.jwt.Jwt;
3534
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
@@ -138,7 +137,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
138137

139138
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
140139
jwtAccessToken.getTokenValue(), jwtAccessToken.getIssuedAt(),
141-
jwtAccessToken.getExpiresAt(), jwtAccessToken.getClaim(OAuth2ParameterNames.SCOPE));
140+
jwtAccessToken.getExpiresAt(), scopes);
142141

143142
// @formatter:off
144143
OAuth2Authorization authorization = OAuth2Authorization.withRegisteredClient(registeredClient)

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProvider.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
3636
import org.springframework.security.oauth2.core.OAuth2RefreshToken2;
3737
import org.springframework.security.oauth2.core.OAuth2TokenType;
38-
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
3938
import org.springframework.security.oauth2.jwt.JoseHeader;
4039
import org.springframework.security.oauth2.jwt.Jwt;
4140
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
@@ -170,7 +169,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
170169

171170
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
172171
jwtAccessToken.getTokenValue(), jwtAccessToken.getIssuedAt(),
173-
jwtAccessToken.getExpiresAt(), jwtAccessToken.getClaim(OAuth2ParameterNames.SCOPE));
172+
jwtAccessToken.getExpiresAt(), scopes);
174173

175174
TokenSettings tokenSettings = registeredClient.getTokenSettings();
176175

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,8 @@ public void authenticateWhenValidCodeThenReturnAccessToken() {
264264
assertThat(accessTokenAuthentication.getRegisteredClient().getId()).isEqualTo(updatedAuthorization.getRegisteredClientId());
265265
assertThat(accessTokenAuthentication.getPrincipal()).isEqualTo(clientPrincipal);
266266
assertThat(accessTokenAuthentication.getAccessToken()).isEqualTo(updatedAuthorization.getAccessToken().getToken());
267+
assertThat(accessTokenAuthentication.getAccessToken().getScopes())
268+
.isEqualTo(authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME));
267269
assertThat(accessTokenAuthentication.getRefreshToken()).isNotNull();
268270
assertThat(accessTokenAuthentication.getRefreshToken()).isEqualTo(updatedAuthorization.getRefreshToken().getToken());
269271
OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = updatedAuthorization.getToken(OAuth2AuthorizationCode.class);
@@ -320,6 +322,8 @@ public void authenticateWhenValidCodeAndAuthenticationRequestThenReturnIdToken()
320322
assertThat(accessTokenAuthentication.getRegisteredClient().getId()).isEqualTo(updatedAuthorization.getRegisteredClientId());
321323
assertThat(accessTokenAuthentication.getPrincipal()).isEqualTo(clientPrincipal);
322324
assertThat(accessTokenAuthentication.getAccessToken()).isEqualTo(updatedAuthorization.getAccessToken().getToken());
325+
assertThat(accessTokenAuthentication.getAccessToken().getScopes())
326+
.isEqualTo(authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME));
323327
assertThat(accessTokenAuthentication.getRefreshToken()).isNotNull();
324328
assertThat(accessTokenAuthentication.getRefreshToken()).isEqualTo(updatedAuthorization.getRefreshToken().getToken());
325329
OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode = updatedAuthorization.getToken(OAuth2AuthorizationCode.class);

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,14 @@
3030
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
3131
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3232
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
33+
import org.springframework.security.oauth2.core.OAuth2TokenType;
3334
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
3435
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
3536
import org.springframework.security.oauth2.jwt.JoseHeaderNames;
3637
import org.springframework.security.oauth2.jwt.Jwt;
3738
import org.springframework.security.oauth2.jwt.JwtEncoder;
3839
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
3940
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
40-
import org.springframework.security.oauth2.core.OAuth2TokenType;
4141
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4242
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
4343
import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
@@ -168,7 +168,8 @@ public void authenticateWhenScopeRequestedThenAccessTokenContainsScope() {
168168
OAuth2ClientCredentialsAuthenticationToken authentication =
169169
new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, requestedScope);
170170

171-
when(this.jwtEncoder.encode(any(), any())).thenReturn(createJwt(requestedScope));
171+
when(this.jwtEncoder.encode(any(), any()))
172+
.thenReturn(createJwt(Collections.singleton("mapped-scoped")));
172173

173174
OAuth2AccessTokenAuthenticationToken accessTokenAuthentication =
174175
(OAuth2AccessTokenAuthenticationToken) this.authenticationProvider.authenticate(authentication);

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProviderTests.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
3535
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
3636
import org.springframework.security.oauth2.core.OAuth2RefreshToken2;
37+
import org.springframework.security.oauth2.core.OAuth2TokenType;
3738
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
3839
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
3940
import org.springframework.security.oauth2.jwt.JoseHeaderNames;
@@ -42,7 +43,6 @@
4243
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
4344
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
4445
import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
45-
import org.springframework.security.oauth2.core.OAuth2TokenType;
4646
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4747
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
4848
import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
@@ -182,7 +182,10 @@ public void authenticateWhenReuseRefreshTokensFalseThenReturnNewRefreshToken() {
182182

183183
@Test
184184
public void authenticateWhenRequestedScopesAuthorizedThenAccessTokenIncludesScopes() {
185-
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
185+
RegisteredClient registeredClient = TestRegisteredClients.registeredClient()
186+
.scope("scope2")
187+
.scope("scope3")
188+
.build();
186189
OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build();
187190
when(this.authorizationService.findByToken(
188191
eq(authorization.getRefreshToken().getToken().getTokenValue()),
@@ -192,7 +195,7 @@ public void authenticateWhenRequestedScopesAuthorizedThenAccessTokenIncludesScop
192195
OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient);
193196
Set<String> authorizedScopes = authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME);
194197
Set<String> requestedScopes = new HashSet<>(authorizedScopes);
195-
requestedScopes.remove("email");
198+
requestedScopes.remove("scope1");
196199
OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken(
197200
authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, requestedScopes);
198201

0 commit comments

Comments
 (0)