Skip to content

Commit fba31df

Browse files
jzheauxjzheaux
committed
Reactive Oidc RP-Initiated Logout
Issue: gh-5350
1 parent 248a8c0 commit fba31df

File tree

3 files changed

+385
-7
lines changed

3 files changed

+385
-7
lines changed

‎config/src/test/java/org/springframework/security/config/web/server/OAuth2LoginTests.java

Lines changed: 96 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,26 +16,41 @@
1616

1717
package org.springframework.security.config.web.server;
1818

19+
import java.time.Instant;
20+
import java.util.Collections;
21+
import java.util.HashMap;
22+
import java.util.Map;
23+
1924
import org.junit.Rule;
2025
import org.junit.Test;
2126
import org.openqa.selenium.WebDriver;
27+
import reactor.core.publisher.Mono;
28+
2229
import org.springframework.beans.factory.annotation.Autowired;
30+
import org.springframework.context.ApplicationContext;
2331
import org.springframework.context.annotation.Bean;
2432
import org.springframework.context.annotation.Configuration;
2533
import org.springframework.security.authentication.ReactiveAuthenticationManager;
2634
import org.springframework.security.authentication.TestingAuthenticationToken;
2735
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
2836
import org.springframework.security.config.oauth2.client.CommonOAuth2Provider;
2937
import org.springframework.security.config.test.SpringTestRule;
38+
import org.springframework.security.core.Authentication;
39+
import org.springframework.security.core.authority.AuthorityUtils;
40+
import org.springframework.security.core.context.SecurityContext;
41+
import org.springframework.security.core.context.SecurityContextImpl;
3042
import org.springframework.security.htmlunit.server.WebTestClientHtmlUnitDriverBuilder;
43+
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
3144
import org.springframework.security.oauth2.client.authentication.OAuth2AuthorizationCodeAuthenticationToken;
3245
import org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken;
3346
import org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequest;
3447
import org.springframework.security.oauth2.client.endpoint.ReactiveOAuth2AccessTokenResponseClient;
3548
import org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeReactiveAuthenticationManager;
49+
import org.springframework.security.oauth2.client.web.server.oidc.logout.OidcClientInitiatedServerLogoutSuccessHandler;
3650
import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
3751
import org.springframework.security.oauth2.client.registration.ClientRegistration;
3852
import org.springframework.security.oauth2.client.registration.InMemoryReactiveClientRegistrationRepository;
53+
import org.springframework.security.oauth2.client.registration.TestClientRegistrations;
3954
import org.springframework.security.oauth2.client.userinfo.ReactiveOAuth2UserService;
4055
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
4156
import org.springframework.security.oauth2.core.OAuth2AccessToken;
@@ -60,21 +75,21 @@
6075
import org.springframework.security.web.server.SecurityWebFilterChain;
6176
import org.springframework.security.web.server.WebFilterChainProxy;
6277
import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
78+
import org.springframework.security.web.server.context.ServerSecurityContextRepository;
6379
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
6480
import org.springframework.test.web.reactive.server.WebTestClient;
81+
import org.springframework.web.reactive.config.EnableWebFlux;
6582
import org.springframework.web.server.ServerWebExchange;
6683
import org.springframework.web.server.WebFilter;
6784
import org.springframework.web.server.WebFilterChain;
68-
import reactor.core.publisher.Mono;
69-
70-
import java.time.Instant;
71-
import java.util.Collections;
72-
import java.util.HashMap;
73-
import java.util.Map;
85+
import org.springframework.web.server.WebHandler;
7486

7587
import static org.assertj.core.api.Assertions.assertThat;
7688
import static org.mockito.ArgumentMatchers.any;
77-
import static org.mockito.Mockito.*;
89+
import static org.mockito.Mockito.mock;
90+
import static org.mockito.Mockito.spy;
91+
import static org.mockito.Mockito.verify;
92+
import static org.mockito.Mockito.when;
7893

7994
/**
8095
* @author Rob Winch
@@ -85,6 +100,8 @@ public class OAuth2LoginTests {
85100
@Rule
86101
public final SpringTestRule spring = new SpringTestRule();
87102

103+
private WebTestClient client;
104+
88105
@Autowired
89106
private WebFilterChainProxy springSecurity;
90107

@@ -100,6 +117,14 @@ public class OAuth2LoginTests {
100117
.clientSecret("secret")
101118
.build();
102119

120+
@Autowired
121+
public void setApplicationContext(ApplicationContext context) {
122+
if (context.getBeanNamesForType(WebHandler.class).length > 0) {
123+
this.client = WebTestClient.bindToApplicationContext(context)
124+
.build();
125+
}
126+
}
127+
103128
@Test
104129
public void defaultLoginPageWithMultipleClientRegistrationsThenLinks() {
105130
this.spring.register(OAuth2LoginWithMultipleClientRegistrations.class).autowire();
@@ -326,6 +351,60 @@ private ReactiveJwtDecoder getJwtDecoder() {
326351
}
327352
}
328353

354+
355+
@Test
356+
public void logoutWhenUsingOidcLogoutHandlerThenRedirects() throws Exception {
357+
this.spring.register(OAuth2LoginConfigWithOidcLogoutSuccessHandler.class).autowire();
358+
359+
OAuth2AuthenticationToken token = new OAuth2AuthenticationToken(
360+
TestOidcUsers.create(),
361+
AuthorityUtils.NO_AUTHORITIES,
362+
getBean(ClientRegistration.class).getRegistrationId());
363+
364+
ServerSecurityContextRepository repository = getBean(ServerSecurityContextRepository.class);
365+
when(repository.load(any())).thenReturn(authentication(token));
366+
367+
this.client.post().uri("/logout")
368+
.exchange()
369+
.expectHeader().valueEquals("Location", "http://logout?id_token_hint=id-token");
370+
}
371+
372+
@EnableWebFlux
373+
@EnableWebFluxSecurity
374+
static class OAuth2LoginConfigWithOidcLogoutSuccessHandler {
375+
private final ServerSecurityContextRepository repository =
376+
mock(ServerSecurityContextRepository.class);
377+
private final ClientRegistration withLogout =
378+
TestClientRegistrations.clientRegistration()
379+
.providerConfigurationMetadata(Collections.singletonMap(
380+
"end_session_endpoint", "http://logout")).build();
381+
382+
@Bean
383+
public SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
384+
385+
http
386+
.csrf().disable()
387+
.logout()
388+
.logoutSuccessHandler(
389+
new OidcClientInitiatedServerLogoutSuccessHandler(
390+
new InMemoryReactiveClientRegistrationRepository(this.withLogout)))
391+
.and()
392+
.securityContextRepository(this.repository);
393+
394+
return http.build();
395+
}
396+
397+
@Bean
398+
ServerSecurityContextRepository securityContextRepository() {
399+
return this.repository;
400+
}
401+
402+
@Bean
403+
ClientRegistration clientRegistration() {
404+
return this.withLogout;
405+
}
406+
}
407+
329408
static class GitHubWebFilter implements WebFilter {
330409

331410
@Override
@@ -336,4 +415,14 @@ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
336415
return chain.filter(exchange);
337416
}
338417
}
418+
419+
Mono<SecurityContext> authentication(Authentication authentication) {
420+
SecurityContext context = new SecurityContextImpl();
421+
context.setAuthentication(authentication);
422+
return Mono.just(context);
423+
}
424+
425+
<T> T getBean(Class<T> beanClass) {
426+
return this.spring.getContext().getBean(beanClass);
427+
}
339428
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/server/oidc/logout/OidcClientInitiatedServerLogoutSuccessHandler.java

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
/*
2+
* Copyright 2002-2019 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.client.web.server.oidc.logout;
18+
19+
import java.net.URI;
20+
import java.nio.charset.StandardCharsets;
21+
22+
import reactor.core.publisher.Mono;
23+
24+
import org.springframework.security.core.Authentication;
25+
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
26+
import org.springframework.security.oauth2.client.registration.ClientRegistration;
27+
import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
28+
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
29+
import org.springframework.security.web.server.DefaultServerRedirectStrategy;
30+
import org.springframework.security.web.server.ServerRedirectStrategy;
31+
import org.springframework.security.web.server.WebFilterExchange;
32+
import org.springframework.security.web.server.authentication.logout.RedirectServerLogoutSuccessHandler;
33+
import org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler;
34+
import org.springframework.util.Assert;
35+
import org.springframework.web.util.UriComponentsBuilder;
36+
37+
/**
38+
* A reactive logout success handler for initiating OIDC logout through the user agent.
39+
*
40+
* @author Josh Cummings
41+
* @since 5.2
42+
* @see <a href="http://openid.net/specs/openid-connect-session-1_0.html#RPLogout">RP-Initiated Logout</a>
43+
* @see org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler
44+
*/
45+
public class OidcClientInitiatedServerLogoutSuccessHandler
46+
implements ServerLogoutSuccessHandler {
47+
48+
private final ServerRedirectStrategy redirectStrategy = new DefaultServerRedirectStrategy();
49+
private final RedirectServerLogoutSuccessHandler serverLogoutSuccessHandler
50+
= new RedirectServerLogoutSuccessHandler();
51+
private final ReactiveClientRegistrationRepository clientRegistrationRepository;
52+
53+
private URI postLogoutRedirectUri;
54+
55+
/**
56+
* Constructs an {@link OidcClientInitiatedServerLogoutSuccessHandler} with the provided parameters
57+
*
58+
* @param clientRegistrationRepository The {@link ReactiveClientRegistrationRepository} to use to derive
59+
* the end_session_endpoint value
60+
*/
61+
public OidcClientInitiatedServerLogoutSuccessHandler
62+
(ReactiveClientRegistrationRepository clientRegistrationRepository) {
63+
64+
Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
65+
this.clientRegistrationRepository = clientRegistrationRepository;
66+
}
67+
68+
/**
69+
* {@inheritDoc}
70+
*/
71+
@Override
72+
public Mono<Void> onLogoutSuccess(WebFilterExchange exchange, Authentication authentication) {
73+
return Mono.just(authentication)
74+
.filter(OAuth2AuthenticationToken.class::isInstance)
75+
.filter(token -> authentication.getPrincipal() instanceof OidcUser)
76+
.map(OAuth2AuthenticationToken.class::cast)
77+
.flatMap(this::endSessionEndpoint)
78+
.map(endSessionEndpoint -> endpointUri(endSessionEndpoint, authentication))
79+
.switchIfEmpty(this.serverLogoutSuccessHandler
80+
.onLogoutSuccess(exchange, authentication).then(Mono.empty()))
81+
.flatMap(endpointUri -> this.redirectStrategy.sendRedirect(exchange.getExchange(), endpointUri));
82+
}
83+
84+
private Mono<URI> endSessionEndpoint(OAuth2AuthenticationToken token) {
85+
String registrationId = token.getAuthorizedClientRegistrationId();
86+
return this.clientRegistrationRepository.findByRegistrationId(registrationId)
87+
.map(ClientRegistration::getProviderDetails)
88+
.map(ClientRegistration.ProviderDetails::getConfigurationMetadata)
89+
.flatMap(configurationMetadata -> Mono.justOrEmpty(configurationMetadata.get("end_session_endpoint")))
90+
.map(Object::toString)
91+
.map(URI::create);
92+
}
93+
94+
private URI endpointUri(URI endSessionEndpoint, Authentication authentication) {
95+
UriComponentsBuilder builder = UriComponentsBuilder.fromUri(endSessionEndpoint);
96+
builder.queryParam("id_token_hint", idToken(authentication));
97+
if (this.postLogoutRedirectUri != null) {
98+
builder.queryParam("post_logout_redirect_uri", this.postLogoutRedirectUri);
99+
}
100+
return builder.encode(StandardCharsets.UTF_8).build().toUri();
101+
}
102+
103+
private String idToken(Authentication authentication) {
104+
return ((OidcUser) authentication.getPrincipal()).getIdToken().getTokenValue();
105+
}
106+
107+
/**
108+
* Set the post logout redirect uri to use
109+
*
110+
* @param postLogoutRedirectUri - A valid URL to which the OP should redirect after logging out the user
111+
*/
112+
public void setPostLogoutRedirectUri(URI postLogoutRedirectUri) {
113+
Assert.notNull(postLogoutRedirectUri, "postLogoutRedirectUri cannot be empty");
114+
this.postLogoutRedirectUri = postLogoutRedirectUri;
115+
}
116+
117+
/**
118+
* The URL to redirect to after successfully logging out when not originally an OIDC login
119+
*
120+
* @param logoutSuccessUrl the url to redirect to. Default is "/login?logout".
121+
*/
122+
public void setLogoutSuccessUrl(URI logoutSuccessUrl) {
123+
Assert.notNull(logoutSuccessUrl, "logoutSuccessUrl cannot be null");
124+
this.serverLogoutSuccessHandler.setLogoutSuccessUrl(logoutSuccessUrl);
125+
}
126+
}

0 commit comments

Comments
 (0)