Skip to content

Missing property for Spring Authorization Server's PAR endpoint #46641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
+29 −0
Closed

Missing property for Spring Authorization Server's PAR endpoint #46641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions ...oot/autoconfigure/security/oauth2/server/servlet/OAuth2AuthorizationServerProperties.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
* OAuth 2.0 Authorization Server properties.
*
* @author Steve Riesenberg
* @author Florian Lemaire
* @since 3.1.0
*/
@ConfigurationProperties("spring.security.oauth2.authorizationserver")
Expand Down Expand Up @@ -144,6 +145,11 @@ public static class Endpoint {
*/
private String tokenIntrospectionUri = "/oauth2/introspect";

/**
* Authorization Server's OAuth 2.0 Pushed Authorization Request Endpoint.
*/
private String pushedAuthorizationRequestUri = "/oauth2/par";

/**
* OpenID Connect 1.0 endpoints.
*/
Expand Down Expand Up @@ -206,6 +212,14 @@ public void setTokenIntrospectionUri(String tokenIntrospectionUri) {
this.tokenIntrospectionUri = tokenIntrospectionUri;
}

public String getPushedAuthorizationRequestUri() {
return this.pushedAuthorizationRequestUri;
}

public void setPushedAuthorizationRequestUri(String pushedAuthorizationRequestUri) {
this.pushedAuthorizationRequestUri = pushedAuthorizationRequestUri;
}

public OidcEndpoint getOidc() {
return this.oidc;
}
Expand Down
2 changes: 2 additions & 0 deletions ...toconfigure/security/oauth2/server/servlet/OAuth2AuthorizationServerPropertiesMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
* Maps {@link OAuth2AuthorizationServerProperties} to Authorization Server types.
*
* @author Steve Riesenberg
* @author Florian Lemaire
*/
final class OAuth2AuthorizationServerPropertiesMapper {

Expand All @@ -61,6 +62,7 @@ AuthorizationServerSettings asAuthorizationServerSettings() {
map.from(endpoint::getJwkSetUri).to(builder::jwkSetEndpoint);
map.from(endpoint::getTokenRevocationUri).to(builder::tokenRevocationEndpoint);
map.from(endpoint::getTokenIntrospectionUri).to(builder::tokenIntrospectionEndpoint);
map.from(endpoint::getPushedAuthorizationRequestUri).to(builder::pushedAuthorizationRequestEndpoint);
map.from(oidc::getLogoutUri).to(builder::oidcLogoutEndpoint);
map.from(oidc::getClientRegistrationUri).to(builder::oidcClientRegistrationEndpoint);
map.from(oidc::getUserInfoUri).to(builder::oidcUserInfoEndpoint);
Expand Down
3 changes: 3 additions & 0 deletions ...igure/security/oauth2/server/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
*
* @author Steve Riesenberg
* @author Madhura Bhave
* @author Florian Lemaire
*/
class OAuth2AuthorizationServerAutoConfigurationTests {

Expand Down Expand Up @@ -133,6 +134,7 @@ void authorizationServerSettingsBeanShouldBeCreatedWhenPropertiesPresent() {
PROPERTIES_PREFIX + ".endpoint.token-uri=/token", PROPERTIES_PREFIX + ".endpoint.jwk-set-uri=/jwks",
PROPERTIES_PREFIX + ".endpoint.token-revocation-uri=/revoke",
PROPERTIES_PREFIX + ".endpoint.token-introspection-uri=/introspect",
PROPERTIES_PREFIX + ".endpoint.pushed-authorization-request-uri=/par",
PROPERTIES_PREFIX + ".endpoint.oidc.logout-uri=/logout",
PROPERTIES_PREFIX + ".endpoint.oidc.client-registration-uri=/register",
PROPERTIES_PREFIX + ".endpoint.oidc.user-info-uri=/user")
Expand All @@ -146,6 +148,7 @@ void authorizationServerSettingsBeanShouldBeCreatedWhenPropertiesPresent() {
assertThat(settings.getJwkSetEndpoint()).isEqualTo("/jwks");
assertThat(settings.getTokenRevocationEndpoint()).isEqualTo("/revoke");
assertThat(settings.getTokenIntrospectionEndpoint()).isEqualTo("/introspect");
assertThat(settings.getPushedAuthorizationRequestEndpoint()).isEqualTo("/par");
assertThat(settings.getOidcLogoutEndpoint()).isEqualTo("/logout");
assertThat(settings.getOidcClientRegistrationEndpoint()).isEqualTo("/register");
assertThat(settings.getOidcUserInfoEndpoint()).isEqualTo("/user");
Expand Down
5 changes: 5 additions & 0 deletions ...figure/security/oauth2/server/servlet/OAuth2AuthorizationServerPropertiesMapperTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@
* Tests for {@link OAuth2AuthorizationServerPropertiesMapper}.
*
* @author Steve Riesenberg
* @author Florian Lemaire
*/
class OAuth2AuthorizationServerPropertiesMapperTests {

Expand Down Expand Up @@ -107,6 +108,7 @@ void getAuthorizationServerSettingsWhenValidParametersShouldAdapt() {
endpoints.setJwkSetUri("/jwks");
endpoints.setTokenRevocationUri("/revoke");
endpoints.setTokenIntrospectionUri("/introspect");
endpoints.setPushedAuthorizationRequestUri("/par");
OAuth2AuthorizationServerProperties.OidcEndpoint oidc = endpoints.getOidc();
oidc.setLogoutUri("/logout");
oidc.setClientRegistrationUri("/register");
Expand All @@ -121,6 +123,7 @@ void getAuthorizationServerSettingsWhenValidParametersShouldAdapt() {
assertThat(settings.getJwkSetEndpoint()).isEqualTo("/jwks");
assertThat(settings.getTokenRevocationEndpoint()).isEqualTo("/revoke");
assertThat(settings.getTokenIntrospectionEndpoint()).isEqualTo("/introspect");
assertThat(settings.getPushedAuthorizationRequestEndpoint()).isEqualTo("/par");
assertThat(settings.getOidcLogoutEndpoint()).isEqualTo("/logout");
assertThat(settings.getOidcClientRegistrationEndpoint()).isEqualTo("/register");
assertThat(settings.getOidcUserInfoEndpoint()).isEqualTo("/user");
Expand All @@ -137,6 +140,7 @@ void getAuthorizationServerSettingsWhenMultipleIssuersAllowedShouldAdapt() {
endpoints.setJwkSetUri("/jwks");
endpoints.setTokenRevocationUri("/revoke");
endpoints.setTokenIntrospectionUri("/introspect");
endpoints.setPushedAuthorizationRequestUri("/par");
OAuth2AuthorizationServerProperties.OidcEndpoint oidc = endpoints.getOidc();
oidc.setLogoutUri("/logout");
oidc.setClientRegistrationUri("/register");
Expand All @@ -151,6 +155,7 @@ void getAuthorizationServerSettingsWhenMultipleIssuersAllowedShouldAdapt() {
assertThat(settings.getJwkSetEndpoint()).isEqualTo("/jwks");
assertThat(settings.getTokenRevocationEndpoint()).isEqualTo("/revoke");
assertThat(settings.getTokenIntrospectionEndpoint()).isEqualTo("/introspect");
assertThat(settings.getPushedAuthorizationRequestEndpoint()).isEqualTo("/par");
assertThat(settings.getOidcLogoutEndpoint()).isEqualTo("/logout");
assertThat(settings.getOidcClientRegistrationEndpoint()).isEqualTo("/register");
assertThat(settings.getOidcUserInfoEndpoint()).isEqualTo("/user");
Expand Down
2 changes: 2 additions & 0 deletions ...utoconfigure/security/oauth2/server/servlet/OAuth2AuthorizationServerPropertiesTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
* Tests for {@link OAuth2AuthorizationServerProperties}.
*
* @author Steve Riesenberg
* @author Florian Lemaire
*/
class OAuth2AuthorizationServerPropertiesTests {

Expand Down Expand Up @@ -85,6 +86,7 @@ void defaultEndpointPropertiesMatchBuilderDefaults() {
assertThat(properties.getJwkSetUri()).isEqualTo(defaults.getJwkSetEndpoint());
assertThat(properties.getTokenRevocationUri()).isEqualTo(defaults.getTokenRevocationEndpoint());
assertThat(properties.getTokenIntrospectionUri()).isEqualTo(defaults.getTokenIntrospectionEndpoint());
assertThat(properties.getPushedAuthorizationRequestUri()).isEqualTo(defaults.getPushedAuthorizationRequestEndpoint());
OAuth2AuthorizationServerProperties.OidcEndpoint oidc = properties.getOidc();
assertThat(oidc.getLogoutUri()).isEqualTo(defaults.getOidcLogoutEndpoint());
assertThat(oidc.getClientRegistrationUri()).isEqualTo(defaults.getOidcClientRegistrationEndpoint());
Expand Down
1 change: 1 addition & 0 deletions ...sts/spring-boot-smoke-test-oauth2-authorization-server/src/main/resources/application.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ spring:
jwk-set-uri: /jwks
token-revocation-uri: /revoke
token-introspection-uri: /introspect
pushed-authorization-request-uri: /par
oidc:
logout-uri: /logout
client-registration-uri: /register
Expand Down
2 changes: 2 additions & 0 deletions ...rc/test/java/smoketest/oauth2/server/SampleOAuth2AuthorizationServerApplicationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ void openidConfigurationShouldAllowAccess() {
assertThat(config.getTokenRevocationEndpoint()).hasToString("https://provider.com/revoke");
assertThat(config.getEndSessionEndpoint()).hasToString("https://provider.com/logout");
assertThat(config.getTokenIntrospectionEndpoint()).hasToString("https://provider.com/introspect");
assertThat(config.getPushedAuthorizationRequestEndpoint()).hasToString("https://provider.com/par");
assertThat(config.getUserInfoEndpoint()).hasToString("https://provider.com/user");
// OIDC Client Registration is disabled by default
assertThat(config.getClientRegistrationEndpoint()).isNull();
Expand All @@ -88,6 +89,7 @@ void authServerMetadataShouldAllowAccess() {
assertThat(config.getJwkSetUrl()).hasToString("https://provider.com/jwks");
assertThat(config.getTokenRevocationEndpoint()).hasToString("https://provider.com/revoke");
assertThat(config.getTokenIntrospectionEndpoint()).hasToString("https://provider.com/introspect");
assertThat(config.getPushedAuthorizationRequestEndpoint()).hasToString("https://provider.com/par");
// OIDC Client Registration is disabled by default
assertThat(config.getClientRegistrationEndpoint()).isNull();
}
Expand Down