Skip to content

Commit cfe3895

Browse files
jgrandjajgrandja
committed
Remove Resource Owner Password Credentials grant
Closes gh-17446
1 parent ee171a1 commit cfe3895

File tree

54 files changed

+103
-3996
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+103
-3996
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configuration/OAuth2ClientConfiguration.java‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,11 @@
5050
import org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider;
5151
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
5252
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
53-
import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
5453
import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
5554
import org.springframework.security.oauth2.client.TokenExchangeOAuth2AuthorizedClientProvider;
5655
import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
5756
import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
5857
import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
59-
import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
6058
import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
6159
import org.springframework.security.oauth2.client.endpoint.TokenExchangeGrantRequest;
6260
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
@@ -173,7 +171,6 @@ static final class OAuth2AuthorizedClientManagerRegistrar
173171
AuthorizationCodeOAuth2AuthorizedClientProvider.class,
174172
RefreshTokenOAuth2AuthorizedClientProvider.class,
175173
ClientCredentialsOAuth2AuthorizedClientProvider.class,
176-
PasswordOAuth2AuthorizedClientProvider.class,
177174
JwtBearerOAuth2AuthorizedClientProvider.class,
178175
TokenExchangeOAuth2AuthorizedClientProvider.class
179176
);
@@ -241,7 +238,6 @@ OAuth2AuthorizedClientManager getAuthorizedClientManager() {
241238
authorizedClientProviders.add(getRefreshTokenAuthorizedClientProvider(authorizedClientProviderBeans));
242239
authorizedClientProviders
243240
.add(getClientCredentialsAuthorizedClientProvider(authorizedClientProviderBeans));
244-
authorizedClientProviders.add(getPasswordAuthorizedClientProvider(authorizedClientProviderBeans));
245241

246242
OAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = getJwtBearerAuthorizedClientProvider(
247243
authorizedClientProviderBeans);
@@ -331,24 +327,6 @@ private OAuth2AuthorizedClientProvider getClientCredentialsAuthorizedClientProvi
331327
return authorizedClientProvider;
332328
}
333329

334-
private OAuth2AuthorizedClientProvider getPasswordAuthorizedClientProvider(
335-
Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
336-
PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
337-
authorizedClientProviders, PasswordOAuth2AuthorizedClientProvider.class);
338-
if (authorizedClientProvider == null) {
339-
authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
340-
}
341-
342-
OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = getBeanOfType(
343-
ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
344-
OAuth2PasswordGrantRequest.class));
345-
if (accessTokenResponseClient != null) {
346-
authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
347-
}
348-
349-
return authorizedClientProvider;
350-
}
351-
352330
private OAuth2AuthorizedClientProvider getJwtBearerAuthorizedClientProvider(
353331
Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
354332
JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(

‎config/src/main/java/org/springframework/security/config/annotation/web/reactive/ReactiveOAuth2ClientConfiguration.java‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -43,15 +43,13 @@
4343
import org.springframework.security.oauth2.client.ClientCredentialsReactiveOAuth2AuthorizedClientProvider;
4444
import org.springframework.security.oauth2.client.DelegatingReactiveOAuth2AuthorizedClientProvider;
4545
import org.springframework.security.oauth2.client.JwtBearerReactiveOAuth2AuthorizedClientProvider;
46-
import org.springframework.security.oauth2.client.PasswordReactiveOAuth2AuthorizedClientProvider;
4746
import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientManager;
4847
import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProvider;
4948
import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientService;
5049
import org.springframework.security.oauth2.client.RefreshTokenReactiveOAuth2AuthorizedClientProvider;
5150
import org.springframework.security.oauth2.client.TokenExchangeReactiveOAuth2AuthorizedClientProvider;
5251
import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
5352
import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
54-
import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
5553
import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
5654
import org.springframework.security.oauth2.client.endpoint.ReactiveOAuth2AccessTokenResponseClient;
5755
import org.springframework.security.oauth2.client.endpoint.TokenExchangeGrantRequest;
@@ -137,7 +135,6 @@ static final class ReactiveOAuth2AuthorizedClientManagerRegistrar
137135
AuthorizationCodeReactiveOAuth2AuthorizedClientProvider.class,
138136
RefreshTokenReactiveOAuth2AuthorizedClientProvider.class,
139137
ClientCredentialsReactiveOAuth2AuthorizedClientProvider.class,
140-
PasswordReactiveOAuth2AuthorizedClientProvider.class,
141138
JwtBearerReactiveOAuth2AuthorizedClientProvider.class,
142139
TokenExchangeReactiveOAuth2AuthorizedClientProvider.class
143140
);
@@ -212,7 +209,6 @@ ReactiveOAuth2AuthorizedClientManager getAuthorizedClientManager() {
212209
authorizedClientProviders.add(getRefreshTokenAuthorizedClientProvider(authorizedClientProviderBeans));
213210
authorizedClientProviders
214211
.add(getClientCredentialsAuthorizedClientProvider(authorizedClientProviderBeans));
215-
authorizedClientProviders.add(getPasswordAuthorizedClientProvider(authorizedClientProviderBeans));
216212

217213
ReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = getJwtBearerAuthorizedClientProvider(
218214
authorizedClientProviderBeans);
@@ -301,24 +297,6 @@ private ReactiveOAuth2AuthorizedClientProvider getClientCredentialsAuthorizedCli
301297
return authorizedClientProvider;
302298
}
303299

304-
private ReactiveOAuth2AuthorizedClientProvider getPasswordAuthorizedClientProvider(
305-
Collection<ReactiveOAuth2AuthorizedClientProvider> authorizedClientProviders) {
306-
PasswordReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
307-
authorizedClientProviders, PasswordReactiveOAuth2AuthorizedClientProvider.class);
308-
if (authorizedClientProvider == null) {
309-
authorizedClientProvider = new PasswordReactiveOAuth2AuthorizedClientProvider();
310-
}
311-
312-
ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = getBeanOfType(
313-
ResolvableType.forClassWithGenerics(ReactiveOAuth2AccessTokenResponseClient.class,
314-
OAuth2PasswordGrantRequest.class));
315-
if (accessTokenResponseClient != null) {
316-
authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
317-
}
318-
319-
return authorizedClientProvider;
320-
}
321-
322300
private ReactiveOAuth2AuthorizedClientProvider getJwtBearerAuthorizedClientProvider(
323301
Collection<ReactiveOAuth2AuthorizedClientProvider> authorizedClientProviders) {
324302
JwtBearerReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(

‎config/src/main/java/org/springframework/security/config/http/OAuth2AuthorizedClientManagerRegistrar.java‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,11 @@
4343
import org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider;
4444
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
4545
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
46-
import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
4746
import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
4847
import org.springframework.security.oauth2.client.TokenExchangeOAuth2AuthorizedClientProvider;
4948
import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
5049
import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
5150
import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
52-
import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
5351
import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
5452
import org.springframework.security.oauth2.client.endpoint.TokenExchangeGrantRequest;
5553
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
@@ -78,7 +76,6 @@ final class OAuth2AuthorizedClientManagerRegistrar implements BeanDefinitionRegi
7876
AuthorizationCodeOAuth2AuthorizedClientProvider.class,
7977
RefreshTokenOAuth2AuthorizedClientProvider.class,
8078
ClientCredentialsOAuth2AuthorizedClientProvider.class,
81-
PasswordOAuth2AuthorizedClientProvider.class,
8279
JwtBearerOAuth2AuthorizedClientProvider.class,
8380
TokenExchangeOAuth2AuthorizedClientProvider.class
8481
);
@@ -133,7 +130,6 @@ private OAuth2AuthorizedClientManager getAuthorizedClientManager() {
133130
authorizedClientProviders.add(getAuthorizationCodeAuthorizedClientProvider(authorizedClientProviderBeans));
134131
authorizedClientProviders.add(getRefreshTokenAuthorizedClientProvider(authorizedClientProviderBeans));
135132
authorizedClientProviders.add(getClientCredentialsAuthorizedClientProvider(authorizedClientProviderBeans));
136-
authorizedClientProviders.add(getPasswordAuthorizedClientProvider(authorizedClientProviderBeans));
137133

138134
OAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = getJwtBearerAuthorizedClientProvider(
139135
authorizedClientProviderBeans);
@@ -225,24 +221,6 @@ private OAuth2AuthorizedClientProvider getClientCredentialsAuthorizedClientProvi
225221
return authorizedClientProvider;
226222
}
227223

228-
private OAuth2AuthorizedClientProvider getPasswordAuthorizedClientProvider(
229-
Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
230-
PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(
231-
authorizedClientProviders, PasswordOAuth2AuthorizedClientProvider.class);
232-
if (authorizedClientProvider == null) {
233-
authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
234-
}
235-
236-
OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient = getBeanOfType(
237-
ResolvableType.forClassWithGenerics(OAuth2AccessTokenResponseClient.class,
238-
OAuth2PasswordGrantRequest.class));
239-
if (accessTokenResponseClient != null) {
240-
authorizedClientProvider.setAccessTokenResponseClient(accessTokenResponseClient);
241-
}
242-
243-
return authorizedClientProvider;
244-
}
245-
246224
private OAuth2AuthorizedClientProvider getJwtBearerAuthorizedClientProvider(
247225
Collection<OAuth2AuthorizedClientProvider> authorizedClientProviders) {
248226
JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = getAuthorizedClientProviderByType(

‎config/src/test/java/org/springframework/security/config/annotation/web/configuration/OAuth2AuthorizedClientManagerConfigurationTests.java‎

Lines changed: 1 addition & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -20,11 +20,7 @@
2020
import java.time.Instant;
2121
import java.util.Arrays;
2222
import java.util.Collections;
23-
import java.util.HashMap;
2423
import java.util.HashSet;
25-
import java.util.Map;
26-
import java.util.Objects;
27-
import java.util.function.Consumer;
2824

2925
import jakarta.servlet.http.HttpServletRequest;
3026
import jakarta.servlet.http.HttpServletResponse;
@@ -48,21 +44,18 @@
4844
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
4945
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
5046
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
51-
import org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider;
5247
import org.springframework.security.oauth2.client.RefreshTokenOAuth2AuthorizedClientProvider;
5348
import org.springframework.security.oauth2.client.TokenExchangeOAuth2AuthorizedClientProvider;
5449
import org.springframework.security.oauth2.client.endpoint.AbstractOAuth2AuthorizationGrantRequest;
5550
import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
5651
import org.springframework.security.oauth2.client.endpoint.OAuth2AccessTokenResponseClient;
5752
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
5853
import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
59-
import org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest;
6054
import org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequest;
6155
import org.springframework.security.oauth2.client.endpoint.TokenExchangeGrantRequest;
6256
import org.springframework.security.oauth2.client.registration.ClientRegistration;
6357
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
6458
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
65-
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
6659
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
6760
import org.springframework.security.oauth2.core.AuthorizationGrantType;
6861
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
@@ -71,13 +64,11 @@
7164
import org.springframework.security.oauth2.core.OAuth2Error;
7265
import org.springframework.security.oauth2.core.TestOAuth2RefreshTokens;
7366
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
74-
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
7567
import org.springframework.security.oauth2.core.endpoint.TestOAuth2AccessTokenResponses;
7668
import org.springframework.security.oauth2.jwt.JoseHeaderNames;
7769
import org.springframework.security.oauth2.jwt.Jwt;
7870
import org.springframework.security.oauth2.jwt.JwtClaimNames;
7971
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
80-
import org.springframework.util.StringUtils;
8172

8273
import static org.assertj.core.api.Assertions.assertThat;
8374
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -237,50 +228,6 @@ private void testClientCredentialsGrant() {
237228
assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.CLIENT_CREDENTIALS);
238229
}
239230

240-
@Test
241-
public void authorizeWhenPasswordAccessTokenResponseClientBeanThenUsed() {
242-
this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
243-
testPasswordGrant();
244-
}
245-
246-
@Test
247-
public void authorizeWhenPasswordAuthorizedClientProviderBeanThenUsed() {
248-
this.spring.register(CustomAuthorizedClientProvidersConfig.class).autowire();
249-
testPasswordGrant();
250-
}
251-
252-
private void testPasswordGrant() {
253-
OAuth2AccessTokenResponse accessTokenResponse = TestOAuth2AccessTokenResponses.accessTokenResponse().build();
254-
given(MOCK_RESPONSE_CLIENT.getTokenResponse(any(OAuth2PasswordGrantRequest.class)))
255-
.willReturn(accessTokenResponse);
256-
257-
TestingAuthenticationToken authentication = new TestingAuthenticationToken("user", "password");
258-
ClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId("facebook");
259-
// @formatter:off
260-
OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
261-
.withClientRegistrationId(clientRegistration.getRegistrationId())
262-
.principal(authentication)
263-
.attribute(HttpServletRequest.class.getName(), this.request)
264-
.attribute(HttpServletResponse.class.getName(), this.response)
265-
.build();
266-
// @formatter:on
267-
this.request.setParameter(OAuth2ParameterNames.USERNAME, "user");
268-
this.request.setParameter(OAuth2ParameterNames.PASSWORD, "password");
269-
OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
270-
assertThat(authorizedClient).isNotNull();
271-
272-
ArgumentCaptor<OAuth2PasswordGrantRequest> grantRequestCaptor = ArgumentCaptor
273-
.forClass(OAuth2PasswordGrantRequest.class);
274-
verify(MOCK_RESPONSE_CLIENT).getTokenResponse(grantRequestCaptor.capture());
275-
276-
OAuth2PasswordGrantRequest grantRequest = grantRequestCaptor.getValue();
277-
assertThat(grantRequest.getClientRegistration().getRegistrationId())
278-
.isEqualTo(clientRegistration.getRegistrationId());
279-
assertThat(grantRequest.getGrantType()).isEqualTo(AuthorizationGrantType.PASSWORD);
280-
assertThat(grantRequest.getUsername()).isEqualTo("user");
281-
assertThat(grantRequest.getPassword()).isEqualTo("password");
282-
}
283-
284231
@Test
285232
public void authorizeWhenJwtBearerAccessTokenResponseClientBeanThenUsed() {
286233
this.spring.register(CustomAccessTokenResponseClientsConfig.class).autowire();
@@ -400,11 +347,6 @@ OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCrede
400347
return new MockAccessTokenResponseClient<>();
401348
}
402349

403-
@Bean
404-
OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> passwordTokenResponseClient() {
405-
return new MockAccessTokenResponseClient<>();
406-
}
407-
408350
@Bean
409351
OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerTokenResponseClient() {
410352
return new MockAccessTokenResponseClient<>();
@@ -440,13 +382,6 @@ ClientCredentialsOAuth2AuthorizedClientProvider clientCredentialsProvider() {
440382
return authorizedClientProvider;
441383
}
442384

443-
@Bean
444-
PasswordOAuth2AuthorizedClientProvider passwordProvider() {
445-
PasswordOAuth2AuthorizedClientProvider authorizedClientProvider = new PasswordOAuth2AuthorizedClientProvider();
446-
authorizedClientProvider.setAccessTokenResponseClient(new MockAccessTokenResponseClient<>());
447-
return authorizedClientProvider;
448-
}
449-
450385
@Bean
451386
JwtBearerOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider() {
452387
JwtBearerOAuth2AuthorizedClientProvider authorizedClientProvider = new JwtBearerOAuth2AuthorizedClientProvider();
@@ -479,11 +414,6 @@ ClientRegistrationRepository clientRegistrationRepository() {
479414
.clientSecret("github-client-secret")
480415
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
481416
.build(),
482-
CommonOAuth2Provider.FACEBOOK.getBuilder("facebook")
483-
.clientId("facebook-client-id")
484-
.clientSecret("facebook-client-secret")
485-
.authorizationGrantType(AuthorizationGrantType.PASSWORD)
486-
.build(),
487417
CommonOAuth2Provider.OKTA.getBuilder("okta")
488418
.clientId("okta-client-id")
489419
.clientSecret("okta-client-secret")
@@ -505,26 +435,6 @@ OAuth2AuthorizedClientRepository authorizedClientRepository() {
505435
return mock(OAuth2AuthorizedClientRepository.class);
506436
}
507437

508-
@Bean
509-
Consumer<DefaultOAuth2AuthorizedClientManager> authorizedClientManagerConsumer() {
510-
return (authorizedClientManager) -> authorizedClientManager
511-
.setContextAttributesMapper((authorizeRequest) -> {
512-
HttpServletRequest request = Objects
513-
.requireNonNull(authorizeRequest.getAttribute(HttpServletRequest.class.getName()));
514-
String username = request.getParameter(OAuth2ParameterNames.USERNAME);
515-
String password = request.getParameter(OAuth2ParameterNames.PASSWORD);
516-
517-
Map<String, Object> attributes = Collections.emptyMap();
518-
if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
519-
attributes = new HashMap<>();
520-
attributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
521-
attributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
522-
}
523-
524-
return attributes;
525-
});
526-
}
527-
528438
}
529439

530440
private static class MockAccessTokenResponseClient<T extends AbstractOAuth2AuthorizationGrantRequest>

0 commit comments

Comments
 (0)