Skip to content

Commit 830f55e

Browse files
jgrandjajgrandja
committed
Revert "Support resolving issuer from current request"
This reverts commit 666d569.
1 parent c418306 commit 830f55e

File tree

34 files changed

+150
-468
lines changed

34 files changed

+150
-468
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -216,17 +216,9 @@ public void init(B builder) {
216216

217217
@Override
218218
public void configure(B builder) {
219-
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
220-
221-
// IMPORTANT:
222-
// This filter must be registered first as it resolves the current issuer identifier and
223-
// sets it as a request attribute under WebAttributes.ISSUER, which may be used by upstream components.
224-
OAuth2AuthorizationServerMetadataEndpointFilter authorizationServerMetadataEndpointFilter =
225-
new OAuth2AuthorizationServerMetadataEndpointFilter(providerSettings);
226-
builder.addFilterBefore(postProcess(authorizationServerMetadataEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
227-
228219
this.configurers.values().forEach(configurer -> configurer.configure(builder));
229220

221+
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
230222
AuthenticationManager authenticationManager = builder.getSharedObject(AuthenticationManager.class);
231223

232224
OAuth2TokenIntrospectionEndpointFilter tokenIntrospectionEndpointFilter =
@@ -246,6 +238,12 @@ public void configure(B builder) {
246238
OAuth2ConfigurerUtils.getJwkSource(builder),
247239
providerSettings.getJwkSetEndpoint());
248240
builder.addFilterBefore(postProcess(jwkSetEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
241+
242+
if (providerSettings.getIssuer() != null) {
243+
OAuth2AuthorizationServerMetadataEndpointFilter authorizationServerMetadataEndpointFilter =
244+
new OAuth2AuthorizationServerMetadataEndpointFilter(providerSettings);
245+
builder.addFilterBefore(postProcess(authorizationServerMetadataEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
246+
}
249247
}
250248

251249
private Map<Class<? extends AbstractOAuth2Configurer>, AbstractOAuth2Configurer> createConfigurers() {

‎oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcConfigurer.java‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,13 +85,16 @@ <B extends HttpSecurityBuilder<B>> void init(B builder) {
8585
}
8686

8787
List<RequestMatcher> requestMatchers = new ArrayList<>();
88-
requestMatchers.add(new AntPathRequestMatcher(
89-
"/.well-known/openid-configuration", HttpMethod.GET.name()));
88+
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
89+
if (providerSettings.getIssuer() != null) {
90+
requestMatchers.add(new AntPathRequestMatcher(
91+
"/.well-known/openid-configuration", HttpMethod.GET.name()));
92+
}
9093
requestMatchers.add(this.userInfoEndpointConfigurer.getRequestMatcher());
9194
if (this.clientRegistrationEndpointConfigurer != null) {
9295
requestMatchers.add(this.clientRegistrationEndpointConfigurer.getRequestMatcher());
9396
}
94-
this.requestMatcher = new OrRequestMatcher(requestMatchers);
97+
this.requestMatcher = requestMatchers.size() > 1 ? new OrRequestMatcher(requestMatchers) : requestMatchers.get(0);
9598
}
9699

97100
@Override
@@ -102,9 +105,11 @@ <B extends HttpSecurityBuilder<B>> void configure(B builder) {
102105
}
103106

104107
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
105-
OidcProviderConfigurationEndpointFilter oidcProviderConfigurationEndpointFilter =
106-
new OidcProviderConfigurationEndpointFilter(providerSettings);
107-
builder.addFilterBefore(postProcess(oidcProviderConfigurationEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
108+
if (providerSettings.getIssuer() != null) {
109+
OidcProviderConfigurationEndpointFilter oidcProviderConfigurationEndpointFilter =
110+
new OidcProviderConfigurationEndpointFilter(providerSettings);
111+
builder.addFilterBefore(postProcess(oidcProviderConfigurationEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
112+
}
108113
}
109114

110115
@Override

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.function.Consumer;
2727
import java.util.function.Supplier;
2828

29+
import org.springframework.beans.factory.annotation.Autowired;
2930
import org.springframework.security.authentication.AuthenticationProvider;
3031
import org.springframework.security.core.Authentication;
3132
import org.springframework.security.core.AuthenticationException;
@@ -86,6 +87,7 @@ public final class OAuth2AuthorizationCodeAuthenticationProvider implements Auth
8687
private final JwtEncoder jwtEncoder;
8788
private OAuth2TokenCustomizer<JwtEncodingContext> jwtCustomizer = (context) -> {};
8889
private Supplier<String> refreshTokenGenerator = DEFAULT_REFRESH_TOKEN_GENERATOR::generateKey;
90+
private ProviderSettings providerSettings;
8991

9092
/**
9193
* Constructs an {@code OAuth2AuthorizationCodeAuthenticationProvider} using the provided parameters.
@@ -122,8 +124,9 @@ public void setRefreshTokenGenerator(Supplier<String> refreshTokenGenerator) {
122124
this.refreshTokenGenerator = refreshTokenGenerator;
123125
}
124126

125-
@Deprecated
127+
@Autowired(required = false)
126128
protected void setProviderSettings(ProviderSettings providerSettings) {
129+
this.providerSettings = providerSettings;
127130
}
128131

129132
@Override
@@ -164,7 +167,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
164167
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
165168
}
166169

167-
String issuer = authorizationCodeAuthentication.getIssuer();
170+
String issuer = this.providerSettings != null ? this.providerSettings.getIssuer() : null;
168171
Set<String> authorizedScopes = authorization.getAttribute(
169172
OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME);
170173

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationToken.java‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,7 @@ public class OAuth2AuthorizationCodeAuthenticationToken extends OAuth2Authorizat
4343
* @param clientPrincipal the authenticated client principal
4444
* @param redirectUri the redirect uri
4545
* @param additionalParameters the additional parameters
46-
* @deprecated Use {@link #OAuth2AuthorizationCodeAuthenticationToken(String, String, Authentication, String, Map)} instead
4746
*/
48-
@Deprecated
4947
public OAuth2AuthorizationCodeAuthenticationToken(String code, Authentication clientPrincipal,
5048
@Nullable String redirectUri, @Nullable Map<String, Object> additionalParameters) {
5149
super(AuthorizationGrantType.AUTHORIZATION_CODE, clientPrincipal, additionalParameters);
@@ -54,24 +52,6 @@ public OAuth2AuthorizationCodeAuthenticationToken(String code, Authentication cl
5452
this.redirectUri = redirectUri;
5553
}
5654

57-
/**
58-
* Constructs an {@code OAuth2AuthorizationCodeAuthenticationToken} using the provided parameters.
59-
*
60-
* @param issuer the issuer identifier
61-
* @param code the authorization code
62-
* @param clientPrincipal the authenticated client principal
63-
* @param redirectUri the redirect uri
64-
* @param additionalParameters the additional parameters
65-
* @since 0.2.1
66-
*/
67-
public OAuth2AuthorizationCodeAuthenticationToken(String issuer, String code, Authentication clientPrincipal,
68-
@Nullable String redirectUri, @Nullable Map<String, Object> additionalParameters) {
69-
super(AuthorizationGrantType.AUTHORIZATION_CODE, issuer, clientPrincipal, additionalParameters);
70-
Assert.hasText(code, "code cannot be empty");
71-
this.code = code;
72-
this.redirectUri = redirectUri;
73-
}
74-
7555
/**
7656
* Returns the authorization code.
7757
*

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationGrantAuthenticationToken.java‎

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@
3939
public class OAuth2AuthorizationGrantAuthenticationToken extends AbstractAuthenticationToken {
4040
private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
4141
private final AuthorizationGrantType authorizationGrantType;
42-
private final String issuer;
4342
private final Authentication clientPrincipal;
4443
private final Map<String, Object> additionalParameters;
4544

@@ -49,40 +48,13 @@ public class OAuth2AuthorizationGrantAuthenticationToken extends AbstractAuthent
4948
* @param authorizationGrantType the authorization grant type
5049
* @param clientPrincipal the authenticated client principal
5150
* @param additionalParameters the additional parameters
52-
* @deprecated Use {@link #OAuth2AuthorizationGrantAuthenticationToken(AuthorizationGrantType, String, Authentication, Map)} instead
5351
*/
54-
@Deprecated
5552
protected OAuth2AuthorizationGrantAuthenticationToken(AuthorizationGrantType authorizationGrantType,
5653
Authentication clientPrincipal, @Nullable Map<String, Object> additionalParameters) {
5754
super(Collections.emptyList());
5855
Assert.notNull(authorizationGrantType, "authorizationGrantType cannot be null");
5956
Assert.notNull(clientPrincipal, "clientPrincipal cannot be null");
6057
this.authorizationGrantType = authorizationGrantType;
61-
this.issuer = null;
62-
this.clientPrincipal = clientPrincipal;
63-
this.additionalParameters = Collections.unmodifiableMap(
64-
additionalParameters != null ?
65-
new HashMap<>(additionalParameters) :
66-
Collections.emptyMap());
67-
}
68-
69-
/**
70-
* Sub-class constructor.
71-
*
72-
* @param authorizationGrantType the authorization grant type
73-
* @param issuer the issuer identifier
74-
* @param clientPrincipal the authenticated client principal
75-
* @param additionalParameters the additional parameters
76-
* @since 0.2.1
77-
*/
78-
protected OAuth2AuthorizationGrantAuthenticationToken(AuthorizationGrantType authorizationGrantType,
79-
String issuer, Authentication clientPrincipal, @Nullable Map<String, Object> additionalParameters) {
80-
super(Collections.emptyList());
81-
Assert.notNull(authorizationGrantType, "authorizationGrantType cannot be null");
82-
Assert.hasText(issuer, "issuer cannot be empty");
83-
Assert.notNull(clientPrincipal, "clientPrincipal cannot be null");
84-
this.authorizationGrantType = authorizationGrantType;
85-
this.issuer = issuer;
8658
this.clientPrincipal = clientPrincipal;
8759
this.additionalParameters = Collections.unmodifiableMap(
8860
additionalParameters != null ?
@@ -99,16 +71,6 @@ public AuthorizationGrantType getGrantType() {
9971
return this.authorizationGrantType;
10072
}
10173

102-
/**
103-
* Returns the issuer identifier.
104-
*
105-
* @return the issuer identifier
106-
* @since 0.2.1
107-
*/
108-
public String getIssuer() {
109-
return this.issuer;
110-
}
111-
11274
@Override
11375
public Object getPrincipal() {
11476
return this.clientPrincipal;

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.util.Set;
2020
import java.util.function.Consumer;
2121

22+
import org.springframework.beans.factory.annotation.Autowired;
2223
import org.springframework.security.authentication.AuthenticationProvider;
2324
import org.springframework.security.core.Authentication;
2425
import org.springframework.security.core.AuthenticationException;
@@ -61,6 +62,7 @@ public final class OAuth2ClientCredentialsAuthenticationProvider implements Auth
6162
private final OAuth2AuthorizationService authorizationService;
6263
private final JwtEncoder jwtEncoder;
6364
private OAuth2TokenCustomizer<JwtEncodingContext> jwtCustomizer = (context) -> {};
65+
private ProviderSettings providerSettings;
6466

6567
/**
6668
* Constructs an {@code OAuth2ClientCredentialsAuthenticationProvider} using the provided parameters.
@@ -88,8 +90,9 @@ public void setJwtCustomizer(OAuth2TokenCustomizer<JwtEncodingContext> jwtCustom
8890
this.jwtCustomizer = jwtCustomizer;
8991
}
9092

91-
@Deprecated
93+
@Autowired(required = false)
9294
protected void setProviderSettings(ProviderSettings providerSettings) {
95+
this.providerSettings = providerSettings;
9396
}
9497

9598
@Override
@@ -115,7 +118,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
115118
authorizedScopes = new LinkedHashSet<>(clientCredentialsAuthentication.getScopes());
116119
}
117120

118-
String issuer = clientCredentialsAuthentication.getIssuer();
121+
String issuer = this.providerSettings != null ? this.providerSettings.getIssuer() : null;
119122

120123
JoseHeader.Builder headersBuilder = JwtUtils.headers();
121124
JwtClaimsSet.Builder claimsBuilder = JwtUtils.accessTokenClaims(

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationToken.java‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -41,32 +41,14 @@ public class OAuth2ClientCredentialsAuthenticationToken extends OAuth2Authorizat
4141
* @param clientPrincipal the authenticated client principal
4242
* @param scopes the requested scope(s)
4343
* @param additionalParameters the additional parameters
44-
* @deprecated Use {@link #OAuth2ClientCredentialsAuthenticationToken(String, Authentication, Set, Map)} instead
4544
*/
46-
@Deprecated
4745
public OAuth2ClientCredentialsAuthenticationToken(Authentication clientPrincipal,
4846
@Nullable Set<String> scopes, @Nullable Map<String, Object> additionalParameters) {
4947
super(AuthorizationGrantType.CLIENT_CREDENTIALS, clientPrincipal, additionalParameters);
5048
this.scopes = Collections.unmodifiableSet(
5149
scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
5250
}
5351

54-
/**
55-
* Constructs an {@code OAuth2ClientCredentialsAuthenticationToken} using the provided parameters.
56-
*
57-
* @param issuer the issuer identifier
58-
* @param clientPrincipal the authenticated client principal
59-
* @param scopes the requested scope(s)
60-
* @param additionalParameters the additional parameters
61-
* @since 0.2.1
62-
*/
63-
public OAuth2ClientCredentialsAuthenticationToken(String issuer, Authentication clientPrincipal,
64-
@Nullable Set<String> scopes, @Nullable Map<String, Object> additionalParameters) {
65-
super(AuthorizationGrantType.CLIENT_CREDENTIALS, issuer, clientPrincipal, additionalParameters);
66-
this.scopes = Collections.unmodifiableSet(
67-
scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
68-
}
69-
7052
/**
7153
* Returns the requested scope(s).
7254
*

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProvider.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.function.Consumer;
2727
import java.util.function.Supplier;
2828

29+
import org.springframework.beans.factory.annotation.Autowired;
2930
import org.springframework.security.authentication.AuthenticationProvider;
3031
import org.springframework.security.core.Authentication;
3132
import org.springframework.security.core.AuthenticationException;
@@ -79,6 +80,7 @@ public final class OAuth2RefreshTokenAuthenticationProvider implements Authentic
7980
private final JwtEncoder jwtEncoder;
8081
private OAuth2TokenCustomizer<JwtEncodingContext> jwtCustomizer = (context) -> {};
8182
private Supplier<String> refreshTokenGenerator = DEFAULT_REFRESH_TOKEN_GENERATOR::generateKey;
83+
private ProviderSettings providerSettings;
8284

8385
/**
8486
* Constructs an {@code OAuth2RefreshTokenAuthenticationProvider} using the provided parameters.
@@ -116,8 +118,9 @@ public void setRefreshTokenGenerator(Supplier<String> refreshTokenGenerator) {
116118
this.refreshTokenGenerator = refreshTokenGenerator;
117119
}
118120

119-
@Deprecated
121+
@Autowired(required = false)
120122
protected void setProviderSettings(ProviderSettings providerSettings) {
123+
this.providerSettings = providerSettings;
121124
}
122125

123126
@Override
@@ -163,7 +166,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
163166
scopes = authorizedScopes;
164167
}
165168

166-
String issuer = refreshTokenAuthentication.getIssuer();
169+
String issuer = this.providerSettings != null ? this.providerSettings.getIssuer() : null;
167170

168171
JoseHeader.Builder headersBuilder = JwtUtils.headers();
169172
JwtClaimsSet.Builder claimsBuilder = JwtUtils.accessTokenClaims(

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationToken.java‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,7 @@ public class OAuth2RefreshTokenAuthenticationToken extends OAuth2AuthorizationGr
4444
* @param clientPrincipal the authenticated client principal
4545
* @param scopes the requested scope(s)
4646
* @param additionalParameters the additional parameters
47-
* @deprecated Use {@link #OAuth2RefreshTokenAuthenticationToken(String, String, Authentication, Set, Map)} instead
4847
*/
49-
@Deprecated
5048
public OAuth2RefreshTokenAuthenticationToken(String refreshToken, Authentication clientPrincipal,
5149
@Nullable Set<String> scopes, @Nullable Map<String, Object> additionalParameters) {
5250
super(AuthorizationGrantType.REFRESH_TOKEN, clientPrincipal, additionalParameters);
@@ -56,25 +54,6 @@ public OAuth2RefreshTokenAuthenticationToken(String refreshToken, Authentication
5654
scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
5755
}
5856

59-
/**
60-
* Constructs an {@code OAuth2RefreshTokenAuthenticationToken} using the provided parameters.
61-
*
62-
* @param issuer the issuer identifier
63-
* @param refreshToken the refresh token
64-
* @param clientPrincipal the authenticated client principal
65-
* @param scopes the requested scope(s)
66-
* @param additionalParameters the additional parameters
67-
* @since 0.2.1
68-
*/
69-
public OAuth2RefreshTokenAuthenticationToken(String issuer, String refreshToken, Authentication clientPrincipal,
70-
@Nullable Set<String> scopes, @Nullable Map<String, Object> additionalParameters) {
71-
super(AuthorizationGrantType.REFRESH_TOKEN, issuer, clientPrincipal, additionalParameters);
72-
Assert.hasText(refreshToken, "refreshToken cannot be empty");
73-
this.refreshToken = refreshToken;
74-
this.scopes = Collections.unmodifiableSet(
75-
scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
76-
}
77-
7857
/**
7958
* Returns the refresh token.
8059
*

0 commit comments

Comments
 (0)