Skip to content

Commit 068f4f0

Browse files
jzheauxjzheaux
committed
Polish Opaque Token
Use OAuth2AuthenticatedPrincipal Use BearerTokenAuthentication Update names to reflect more generic approach. Fixes gh-7344 Fixes gh-7345
1 parent c019507 commit 068f4f0

File tree

19 files changed

+222
-520
lines changed

19 files changed

+222
-520
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
3838
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
3939
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
40-
import org.springframework.security.oauth2.server.resource.authentication.OAuth2IntrospectionAuthenticationProvider;
40+
import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider;
4141
import org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector;
4242
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
4343
import org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationEntryPoint;
@@ -388,8 +388,8 @@ AuthenticationManager getAuthenticationManager(H http) {
388388
}
389389

390390
OpaqueTokenIntrospector introspector = getIntrospector();
391-
OAuth2IntrospectionAuthenticationProvider provider =
392-
new OAuth2IntrospectionAuthenticationProvider(introspector);
391+
OpaqueTokenAuthenticationProvider provider =
392+
new OpaqueTokenAuthenticationProvider(introspector);
393393
http.authenticationProvider(provider);
394394

395395
return http.getSharedObject(AuthenticationManager.class);

‎config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@
8787
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoderFactory;
8888
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
8989
import org.springframework.security.oauth2.server.resource.authentication.JwtReactiveAuthenticationManager;
90-
import org.springframework.security.oauth2.server.resource.authentication.OAuth2IntrospectionReactiveAuthenticationManager;
90+
import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenReactiveAuthenticationManager;
9191
import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;
9292
import org.springframework.security.oauth2.server.resource.introspection.NimbusReactiveOpaqueTokenIntrospector;
9393
import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector;
@@ -1867,7 +1867,7 @@ public OAuth2ResourceServerSpec and() {
18671867
}
18681868

18691869
protected ReactiveAuthenticationManager getAuthenticationManager() {
1870-
return new OAuth2IntrospectionReactiveAuthenticationManager(getIntrospector());
1870+
return new OpaqueTokenReactiveAuthenticationManager(getIntrospector());
18711871
}
18721872

18731873
protected ReactiveOpaqueTokenIntrospector getIntrospector() {

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,8 @@
7878
import org.springframework.security.core.annotation.AuthenticationPrincipal;
7979
import org.springframework.security.core.authority.SimpleGrantedAuthority;
8080
import org.springframework.security.core.userdetails.UserDetailsService;
81+
import org.springframework.security.oauth2.core.DefaultOAuth2AuthenticatedPrincipal;
8182
import org.springframework.security.oauth2.core.OAuth2Error;
82-
import org.springframework.security.oauth2.core.OAuth2TokenAttributes;
8383
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
8484
import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
8585
import org.springframework.security.oauth2.jose.jws.JwsAlgorithms;
@@ -91,7 +91,7 @@
9191
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
9292
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
9393
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
94-
import org.springframework.security.oauth2.server.resource.authentication.OAuth2IntrospectionAuthenticationToken;
94+
import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
9595
import org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector;
9696
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
9797
import org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationEntryPoint;
@@ -159,8 +159,9 @@ public class OAuth2ResourceServerConfigurerTests {
159159
private static final String INTROSPECTION_URI = "https://idp.example.com";
160160
private static final String CLIENT_ID = "client-id";
161161
private static final String CLIENT_SECRET = "client-secret";
162-
private static final OAuth2IntrospectionAuthenticationToken INTROSPECTION_AUTHENTICATION_TOKEN =
163-
new OAuth2IntrospectionAuthenticationToken(noScopes(), new OAuth2TokenAttributes(JWT_CLAIMS), Collections.emptyList());
162+
private static final BearerTokenAuthentication INTROSPECTION_AUTHENTICATION_TOKEN =
163+
new BearerTokenAuthentication(new DefaultOAuth2AuthenticatedPrincipal(JWT_CLAIMS, Collections.emptyList()),
164+
noScopes(), Collections.emptyList());
164165

165166
@Autowired(required = false)
166167
MockMvc mvc;

‎oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2TokenAttributes.java

Lines changed: 0 additions & 58 deletions
This file was deleted.

‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/OAuth2IntrospectionAuthenticationToken.java

Lines changed: 0 additions & 100 deletions
This file was deleted.

‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/OAuth2IntrospectionAuthenticationProvider.java renamed to ‎oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/OpaqueTokenAuthenticationProvider.java

Lines changed: 18 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -16,32 +16,26 @@
1616
package org.springframework.security.oauth2.server.resource.authentication;
1717

1818
import java.time.Instant;
19-
import java.util.ArrayList;
2019
import java.util.Collection;
21-
import java.util.Collections;
22-
import java.util.List;
23-
import java.util.Map;
2420

2521
import org.springframework.http.HttpStatus;
2622
import org.springframework.security.authentication.AbstractAuthenticationToken;
2723
import org.springframework.security.authentication.AuthenticationProvider;
2824
import org.springframework.security.core.Authentication;
2925
import org.springframework.security.core.AuthenticationException;
3026
import org.springframework.security.core.GrantedAuthority;
31-
import org.springframework.security.core.authority.SimpleGrantedAuthority;
3227
import org.springframework.security.oauth2.core.OAuth2AccessToken;
28+
import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
3329
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3430
import org.springframework.security.oauth2.core.OAuth2Error;
35-
import org.springframework.security.oauth2.core.OAuth2TokenAttributes;
36-
import org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionException;
37-
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
3831
import org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken;
3932
import org.springframework.security.oauth2.server.resource.BearerTokenError;
33+
import org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionException;
34+
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
4035
import org.springframework.util.Assert;
4136

4237
import static org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionClaimNames.EXPIRES_AT;
4338
import static org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionClaimNames.ISSUED_AT;
44-
import static org.springframework.security.oauth2.server.resource.introspection.OAuth2IntrospectionClaimNames.SCOPE;
4539

4640
/**
4741
* An {@link AuthenticationProvider} implementation for opaque
@@ -65,20 +59,20 @@
6559
* @since 5.2
6660
* @see AuthenticationProvider
6761
*/
68-
public final class OAuth2IntrospectionAuthenticationProvider implements AuthenticationProvider {
62+
public final class OpaqueTokenAuthenticationProvider implements AuthenticationProvider {
6963
private static final BearerTokenError DEFAULT_INVALID_TOKEN =
7064
invalidToken("An error occurred while attempting to introspect the token: Invalid token");
7165

72-
private OpaqueTokenIntrospector introspectionClient;
66+
private OpaqueTokenIntrospector introspector;
7367

7468
/**
75-
* Creates a {@code OAuth2IntrospectionAuthenticationProvider} with the provided parameters
69+
* Creates a {@code OpaqueTokenAuthenticationProvider} with the provided parameters
7670
*
77-
* @param introspectionClient The {@link OpaqueTokenIntrospector} to use
71+
* @param introspector The {@link OpaqueTokenIntrospector} to use
7872
*/
79-
public OAuth2IntrospectionAuthenticationProvider(OpaqueTokenIntrospector introspectionClient) {
80-
Assert.notNull(introspectionClient, "introspectionClient cannot be null");
81-
this.introspectionClient = introspectionClient;
73+
public OpaqueTokenAuthenticationProvider(OpaqueTokenIntrospector introspector) {
74+
Assert.notNull(introspector, "introspector cannot be null");
75+
this.introspector = introspector;
8276
}
8377

8478
/**
@@ -97,15 +91,15 @@ public Authentication authenticate(Authentication authentication) throws Authent
9791
}
9892
BearerTokenAuthenticationToken bearer = (BearerTokenAuthenticationToken) authentication;
9993

100-
Map<String, Object> claims;
94+
OAuth2AuthenticatedPrincipal principal;
10195
try {
102-
claims = this.introspectionClient.introspect(bearer.getToken());
96+
principal = this.introspector.introspect(bearer.getToken());
10397
} catch (OAuth2IntrospectionException failed) {
10498
OAuth2Error invalidToken = invalidToken(failed.getMessage());
10599
throw new OAuth2AuthenticationException(invalidToken);
106100
}
107101

108-
AbstractAuthenticationToken result = convert(bearer.getToken(), claims);
102+
AbstractAuthenticationToken result = convert(principal, bearer.getToken());
109103
result.setDetails(bearer.getDetails());
110104
return result;
111105
}
@@ -118,22 +112,12 @@ public boolean supports(Class<?> authentication) {
118112
return BearerTokenAuthenticationToken.class.isAssignableFrom(authentication);
119113
}
120114

121-
private AbstractAuthenticationToken convert(String token, Map<String, Object> claims) {
122-
Instant iat = (Instant) claims.get(ISSUED_AT);
123-
Instant exp = (Instant) claims.get(EXPIRES_AT);
124-
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
115+
private AbstractAuthenticationToken convert(OAuth2AuthenticatedPrincipal principal, String token) {
116+
Instant iat = principal.getAttribute(ISSUED_AT);
117+
Instant exp = principal.getAttribute(EXPIRES_AT);
118+
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
125119
token, iat, exp);
126-
Collection<GrantedAuthority> authorities = extractAuthorities(claims);
127-
return new OAuth2IntrospectionAuthenticationToken(accessToken, new OAuth2TokenAttributes(claims), authorities);
128-
}
129-
130-
private Collection<GrantedAuthority> extractAuthorities(Map<String, Object> claims) {
131-
Collection<String> scopes = (Collection<String>) claims.getOrDefault(SCOPE, Collections.emptyList());
132-
List<GrantedAuthority> authorities = new ArrayList<>();
133-
for (String scope : scopes) {
134-
authorities.add(new SimpleGrantedAuthority("SCOPE_" + scope));
135-
}
136-
return authorities;
120+
return new BearerTokenAuthentication(principal, accessToken, principal.getAuthorities());
137121
}
138122

139123
private static BearerTokenError invalidToken(String message) {

0 commit comments

Comments
 (0)