Skip to content

Commit 8e5ae84

Browse files
wilkinsonawilkinsona
committed
Adapt to nullability changes in spring-security-oauth2-jose
See gh-49446
1 parent 79ef955 commit 8e5ae84

File tree

6 files changed

+38
-14
lines changed

6 files changed

+38
-14
lines changed

‎module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerPropertiesMapper.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
3434
import org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat;
3535
import org.springframework.security.oauth2.server.authorization.settings.TokenSettings;
36+
import org.springframework.util.Assert;
3637

3738
/**
3839
* Maps {@link OAuth2AuthorizationServerProperties} to Authorization Server types.
@@ -132,11 +133,14 @@ private JwsAlgorithm jwsAlgorithm(String signingAlgorithm) {
132133
if (jwsAlgorithm == null) {
133134
jwsAlgorithm = MacAlgorithm.from(name);
134135
}
136+
Assert.notNull(jwsAlgorithm, "JWS algorithm " + name + " is unknown");
135137
return jwsAlgorithm;
136138
}
137139

138140
private SignatureAlgorithm signatureAlgorithm(String signatureAlgorithm) {
139-
return SignatureAlgorithm.from(signatureAlgorithm.toUpperCase(Locale.ROOT));
141+
SignatureAlgorithm algorithm = SignatureAlgorithm.from(signatureAlgorithm.toUpperCase(Locale.ROOT));
142+
Assert.notNull(algorithm, "Signature algorithm " + signatureAlgorithm + " is unknown");
143+
return algorithm;
140144
}
141145

142146
}

‎module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfigurationTests.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
3232

3333
import static org.assertj.core.api.Assertions.assertThat;
34+
import static org.mockito.Mockito.mock;
3435

3536
/**
3637
* Tests for {@link OAuth2AuthorizationServerJwtAutoConfiguration}.
@@ -96,7 +97,7 @@ static class TestJwtDecoderConfiguration {
9697

9798
@Bean
9899
JwtDecoder jwtDecoder() {
99-
return (token) -> null;
100+
return mock(JwtDecoder.class);
100101
}
101102

102103
}

‎module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtDecoderConfiguration.java‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
3232
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
3333
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
34+
import org.springframework.boot.context.properties.source.InvalidConfigurationPropertyValueException;
3435
import org.springframework.context.annotation.Bean;
3536
import org.springframework.context.annotation.Configuration;
3637
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
@@ -47,6 +48,7 @@
4748
import org.springframework.security.oauth2.jwt.SupplierJwtDecoder;
4849
import org.springframework.util.Assert;
4950
import org.springframework.util.CollectionUtils;
51+
import org.springframework.util.StringUtils;
5052

5153
/**
5254
* {@link Configuration @Configuration} for JWT decoder beans.
@@ -82,7 +84,7 @@ class JwtDecoderConfiguration {
8284
@ConditionalOnPublicKeyJwtDecoder
8385
JwtDecoder jwtDecoderByPublicKeyValue() throws Exception {
8486
PublicKeyJwtDecoderBuilder builder = NimbusJwtDecoder.withPublicKey(getReadPublicKey());
85-
builder.signatureAlgorithm(SignatureAlgorithm.from(exactlyOneAlgorithm()));
87+
builder.signatureAlgorithm(exactlyOneAlgorithm());
8688
NimbusJwtDecoder decoder = builder.build();
8789
decoder.setJwtValidator(getValidator());
8890
return decoder;
@@ -98,18 +100,26 @@ private byte[] decodeKeyProperty(String value) {
98100
.decode(value.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", ""));
99101
}
100102

101-
private String exactlyOneAlgorithm() {
103+
private SignatureAlgorithm exactlyOneAlgorithm() {
102104
List<String> algorithms = this.properties.getJwsAlgorithms();
103105
Assert.state(algorithms != null && algorithms.size() == 1,
104106
() -> "Creating a JWT decoder using a public key requires exactly one JWS algorithm but "
105107
+ algorithms.size() + " were configured");
106-
return algorithms.get(0);
108+
SignatureAlgorithm algorithm = SignatureAlgorithm.from(algorithms.get(0));
109+
if (algorithm == null) {
110+
throw new InvalidConfigurationPropertyValueException(
111+
"spring.security.oauth2.resourceserver.jwt.jws-algorithms",
112+
StringUtils.collectionToCommaDelimitedString(algorithms), "Unknown algorithm");
113+
}
114+
return algorithm;
107115
}
108116

109117
@Bean
110118
@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
111119
JwtDecoder jwtDecoderByJwkKeySetUri() {
112-
JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withJwkSetUri(this.properties.getJwkSetUri());
120+
String jwkSetUri = this.properties.getJwkSetUri();
121+
Assert.state(jwkSetUri != null, "No JWK Set URI property specified");
122+
JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri);
113123
builder.jwsAlgorithms(this::jwsAlgorithms);
114124
return buildJwkSetUriJwtDecoder(builder);
115125
}

‎module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtDecoderConfiguration.java‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.springframework.beans.factory.ObjectProvider;
3434
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
3535
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
36+
import org.springframework.boot.context.properties.source.InvalidConfigurationPropertyValueException;
3637
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnIssuerLocationJwtDecoder;
3738
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnPublicKeyJwtDecoder;
3839
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
@@ -88,7 +89,7 @@ class ReactiveJwtDecoderConfiguration {
8889
NimbusReactiveJwtDecoder reactiveJwtDecoderByPublicKeyValue() throws Exception {
8990
RSAPublicKey publicKey = getReadPublicKey();
9091
PublicKeyReactiveJwtDecoderBuilder builder = NimbusReactiveJwtDecoder.withPublicKey(publicKey);
91-
builder.signatureAlgorithm(SignatureAlgorithm.from(exactlyOneAlgorithm()));
92+
builder.signatureAlgorithm(exactlyOneAlgorithm());
9293
NimbusReactiveJwtDecoder decoder = builder.build();
9394
decoder.setJwtValidator(getValidator());
9495
return decoder;
@@ -104,19 +105,25 @@ private byte[] decodeKeyProperty(String value) {
104105
.decode(value.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", ""));
105106
}
106107

107-
private String exactlyOneAlgorithm() {
108+
private SignatureAlgorithm exactlyOneAlgorithm() {
108109
List<String> algorithms = this.properties.getJwsAlgorithms();
109110
Assert.state(algorithms != null && algorithms.size() == 1,
110111
() -> "Creating a JWT decoder using a public key requires exactly one JWS algorithm but "
111112
+ algorithms.size() + " were configured");
112-
return algorithms.get(0);
113+
SignatureAlgorithm algorithm = SignatureAlgorithm.from(algorithms.get(0));
114+
if (algorithm == null) {
115+
throw new InvalidConfigurationPropertyValueException(
116+
"spring.security.oauth2.resourceserver.jwt.jws-algorithms", algorithms.get(0), "Unknown algorithm");
117+
}
118+
return algorithm;
113119
}
114120

115121
@Bean
116122
@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
117123
ReactiveJwtDecoder reactiveJwtDecoderByJwkKeySetUri() {
118-
JwkSetUriReactiveJwtDecoderBuilder builder = NimbusReactiveJwtDecoder
119-
.withJwkSetUri(this.properties.getJwkSetUri());
124+
String jwkSetUri = this.properties.getJwkSetUri();
125+
Assert.notNull(jwkSetUri, "No JWK Set URI specified");
126+
JwkSetUriReactiveJwtDecoderBuilder builder = NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri);
120127
builder.jwsAlgorithms(this::jwsAlgorithms);
121128
return buildJwkSetUriJwtDecoder(builder);
122129
}

‎module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,10 @@ public Stream<? extends Arguments> provideArguments(ParameterDeclarations parame
7272
.claim(customPrincipalClaim, customPrincipalValue);
7373
Jwt noAuthoritiesCustomizationsJwt = jwtBuilder.claim("scp", jwtScopes[0] + " " + jwtScopes[1]).build();
7474
Jwt customAuthoritiesDelimiterJwt = jwtBuilder.claim("scp", jwtScopes[0] + "~" + jwtScopes[1]).build();
75-
Jwt customAuthoritiesClaimJwt = jwtBuilder.claim("scp", null)
75+
Jwt customAuthoritiesClaimJwt = jwtBuilder.claim("scp", "value")
7676
.claim(customAuthoritiesClaim, jwtScopes[0] + " " + jwtScopes[1])
7777
.build();
78-
Jwt customAuthoritiesClaimAndDelimiterJwt = jwtBuilder.claim("scp", null)
78+
Jwt customAuthoritiesClaimAndDelimiterJwt = jwtBuilder.claim("scp", "value")
7979
.claim(customAuthoritiesClaim, jwtScopes[0] + "~" + jwtScopes[1])
8080
.build();
8181
String[] customPrefixAuthorities = { customPrefix + jwtScopes[0], customPrefix + jwtScopes[1] };

‎module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
import tools.jackson.databind.json.JsonMapper;
4747

4848
import org.springframework.boot.autoconfigure.AutoConfigurations;
49+
import org.springframework.boot.context.properties.source.InvalidConfigurationPropertyValueException;
4950
import org.springframework.boot.test.context.FilteredClassLoader;
5051
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
5152
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
@@ -314,7 +315,8 @@ void autoConfigurationShouldFailIfAlgorithmIsInvalid() {
314315
"spring.security.oauth2.resourceserver.jwt.jws-algorithms=NOT_VALID")
315316
.run((context) -> assertThat(context).hasFailed()
316317
.getFailure()
317-
.hasMessageContaining("signatureAlgorithm cannot be null"));
318+
.hasMessageContaining("Unknown algorithm")
319+
.hasRootCauseExactlyInstanceOf(InvalidConfigurationPropertyValueException.class));
318320
}
319321

320322
@Test

0 commit comments

Comments
 (0)