getSetting("name2")).isEqualTo("value2");
62 | }
63 |
64 | }
65 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/jwt/JwtEncoder.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.jwt;
17 |
18 | /**
19 | * Implementations of this interface are responsible for encoding
20 | * a JSON Web Token (JWT) to it's compact claims representation format.
21 | *
22 | *
23 | * JWTs may be represented using the JWS Compact Serialization format for a
24 | * JSON Web Signature (JWS) structure or JWE Compact Serialization format for a
25 | * JSON Web Encryption (JWE) structure. Therefore, implementors are responsible
26 | * for signing a JWS and/or encrypting a JWE.
27 | *
28 | * @author Anoop Garlapati
29 | * @author Joe Grandja
30 | * @since 0.0.1
31 | * @see Jwt
32 | * @see JoseHeader
33 | * @see JwtClaimsSet
34 | * @see JwtDecoder
35 | * @see JSON Web Token (JWT)
36 | * @see JSON Web Signature (JWS)
37 | * @see JSON Web Encryption (JWE)
38 | * @see JWS Compact Serialization
39 | * @see JWE Compact Serialization
40 | */
41 | @FunctionalInterface
42 | public interface JwtEncoder {
43 |
44 | /**
45 | * Encode the JWT to it's compact claims representation format.
46 | *
47 | * @param headers the JOSE header
48 | * @param claims the JWT Claims Set
49 | * @return a {@link Jwt}
50 | * @throws JwtEncodingException if an error occurs while attempting to encode the JWT
51 | */
52 | Jwt encode(JoseHeader headers, JwtClaimsSet claims) throws JwtEncodingException;
53 |
54 | }
55 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationService.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization;
17 |
18 | import org.springframework.lang.Nullable;
19 | import org.springframework.security.oauth2.core.OAuth2TokenType;
20 |
21 | /**
22 | * Implementations of this interface are responsible for the management
23 | * of {@link OAuth2Authorization OAuth 2.0 Authorization(s)}.
24 | *
25 | * @author Joe Grandja
26 | * @since 0.0.1
27 | * @see OAuth2Authorization
28 | * @see OAuth2TokenType
29 | */
30 | public interface OAuth2AuthorizationService {
31 |
32 | /**
33 | * Saves the {@link OAuth2Authorization}.
34 | *
35 | * @param authorization the {@link OAuth2Authorization}
36 | */
37 | void save(OAuth2Authorization authorization);
38 |
39 | /**
40 | * Removes the {@link OAuth2Authorization}.
41 | *
42 | * @param authorization the {@link OAuth2Authorization}
43 | */
44 | void remove(OAuth2Authorization authorization);
45 |
46 | /**
47 | * Returns the {@link OAuth2Authorization} identified by the provided {@code id},
48 | * or {@code null} if not found.
49 | *
50 | * @param id the authorization identifier
51 | * @return the {@link OAuth2Authorization} if found, otherwise {@code null}
52 | */
53 | @Nullable
54 | OAuth2Authorization findById(String id);
55 |
56 | /**
57 | * Returns the {@link OAuth2Authorization} containing the provided {@code token},
58 | * or {@code null} if not found.
59 | *
60 | * @param token the token credential
61 | * @param tokenType the {@link OAuth2TokenType token type}
62 | * @return the {@link OAuth2Authorization} if found, otherwise {@code null}
63 | */
64 | @Nullable
65 | OAuth2Authorization findByToken(String token, @Nullable OAuth2TokenType tokenType);
66 |
67 | }
68 |
--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.adoc:
--------------------------------------------------------------------------------
1 | = Contributor Code of Conduct
2 |
3 | As contributors and maintainers of this project, and in the interest of fostering an open
4 | and welcoming community, we pledge to respect all people who contribute through reporting
5 | issues, posting feature requests, updating documentation, submitting pull requests or
6 | patches, and other activities.
7 |
8 | We are committed to making participation in this project a harassment-free experience for
9 | everyone, regardless of level of experience, gender, gender identity and expression,
10 | sexual orientation, disability, personal appearance, body size, race, ethnicity, age,
11 | religion, or nationality.
12 |
13 | Examples of unacceptable behavior by participants include:
14 |
15 | * The use of sexualized language or imagery
16 | * Personal attacks
17 | * Trolling or insulting/derogatory comments
18 | * Public or private harassment
19 | * Publishing other's private information, such as physical or electronic addresses,
20 | without explicit permission
21 | * Other unethical or unprofessional conduct
22 |
23 | Project maintainers have the right and responsibility to remove, edit, or reject comments,
24 | commits, code, wiki edits, issues, and other contributions that are not aligned to this
25 | Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors
26 | that they deem inappropriate, threatening, offensive, or harmful.
27 |
28 | By adopting this Code of Conduct, project maintainers commit themselves to fairly and
29 | consistently applying these principles to every aspect of managing this project. Project
30 | maintainers who do not follow or enforce the Code of Conduct may be permanently removed
31 | from the project team.
32 |
33 | This Code of Conduct applies both within project spaces and in public spaces when an
34 | individual is representing the project or its community.
35 |
36 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by
37 | contacting a project maintainer at spring-code-of-conduct@pivotal.io . All complaints will
38 | be reviewed and investigated and will result in a response that is deemed necessary and
39 | appropriate to the circumstances. Maintainers are obligated to maintain confidentiality
40 | with regard to the reporter of an incident.
41 |
42 | This Code of Conduct is adapted from the
43 | https://contributor-covenant.org[Contributor Covenant], version 1.3.0, available at
44 | https://contributor-covenant.org/version/1/3/0/[contributor-covenant.org/version/1/3/0/]
45 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/JsonNodeUtils.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2002-2020 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 |
17 | package org.springframework.security.oauth2.server.authorization.jackson2;
18 |
19 | import java.util.Map;
20 | import java.util.Set;
21 |
22 | import com.fasterxml.jackson.core.type.TypeReference;
23 | import com.fasterxml.jackson.databind.JsonNode;
24 | import com.fasterxml.jackson.databind.ObjectMapper;
25 |
26 | /**
27 | * TODO
28 | * This class is a straight copy from Spring Security.
29 | * It should be consolidated when merging this codebase into Spring Security.
30 | *
31 | * Utility class for {@code JsonNode}.
32 | *
33 | * @author Joe Grandja
34 | * @since 5.3
35 | */
36 | abstract class JsonNodeUtils {
37 |
38 | static final TypeReference> STRING_SET = new TypeReference>() {
39 | };
40 |
41 | static final TypeReference> STRING_OBJECT_MAP = new TypeReference>() {
42 | };
43 |
44 | static String findStringValue(JsonNode jsonNode, String fieldName) {
45 | if (jsonNode == null) {
46 | return null;
47 | }
48 | JsonNode value = jsonNode.findValue(fieldName);
49 | return (value != null && value.isTextual()) ? value.asText() : null;
50 | }
51 |
52 | static T findValue(JsonNode jsonNode, String fieldName, TypeReference valueTypeReference,
53 | ObjectMapper mapper) {
54 | if (jsonNode == null) {
55 | return null;
56 | }
57 | JsonNode value = jsonNode.findValue(fieldName);
58 | return (value != null && value.isContainerNode()) ? mapper.convertValue(value, valueTypeReference) : null;
59 | }
60 |
61 | static JsonNode findObjectNode(JsonNode jsonNode, String fieldName) {
62 | if (jsonNode == null) {
63 | return null;
64 | }
65 | JsonNode value = jsonNode.findValue(fieldName);
66 | return (value != null && value.isObject()) ? value : null;
67 | }
68 |
69 | }
70 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationToken.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.authentication;
17 |
18 | import java.util.Collections;
19 | import java.util.HashSet;
20 | import java.util.Map;
21 | import java.util.Set;
22 |
23 | import org.springframework.lang.Nullable;
24 | import org.springframework.security.core.Authentication;
25 | import org.springframework.security.oauth2.core.AuthorizationGrantType;
26 |
27 | /**
28 | * An {@link Authentication} implementation used for the OAuth 2.0 Client Credentials Grant.
29 | *
30 | * @author Alexey Nesterov
31 | * @since 0.0.1
32 | * @see OAuth2AuthorizationGrantAuthenticationToken
33 | * @see OAuth2ClientCredentialsAuthenticationProvider
34 | */
35 | public class OAuth2ClientCredentialsAuthenticationToken extends OAuth2AuthorizationGrantAuthenticationToken {
36 | private final Set scopes;
37 |
38 | /**
39 | * Constructs an {@code OAuth2ClientCredentialsAuthenticationToken} using the provided parameters.
40 | *
41 | * @param clientPrincipal the authenticated client principal
42 | * @param scopes the requested scope(s)
43 | * @param additionalParameters the additional parameters
44 | */
45 | public OAuth2ClientCredentialsAuthenticationToken(Authentication clientPrincipal,
46 | @Nullable Set scopes, @Nullable Map additionalParameters) {
47 | super(AuthorizationGrantType.CLIENT_CREDENTIALS, clientPrincipal, additionalParameters);
48 | this.scopes = Collections.unmodifiableSet(
49 | scopes != null ? new HashSet<>(scopes) : Collections.emptySet());
50 | }
51 |
52 | /**
53 | * Returns the requested scope(s).
54 | *
55 | * @return the requested scope(s), or an empty {@code Set} if not available
56 | */
57 | public Set getScopes() {
58 | return this.scopes;
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/samples/custom-consent-authorizationserver/src/main/java/sample/jose/Jwks.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.jose;
17 |
18 | import java.security.KeyPair;
19 | import java.security.interfaces.ECPrivateKey;
20 | import java.security.interfaces.ECPublicKey;
21 | import java.security.interfaces.RSAPrivateKey;
22 | import java.security.interfaces.RSAPublicKey;
23 | import java.util.UUID;
24 |
25 | import javax.crypto.SecretKey;
26 |
27 | import com.nimbusds.jose.jwk.Curve;
28 | import com.nimbusds.jose.jwk.ECKey;
29 | import com.nimbusds.jose.jwk.OctetSequenceKey;
30 | import com.nimbusds.jose.jwk.RSAKey;
31 |
32 | /**
33 | * @author Joe Grandja
34 | */
35 | public final class Jwks {
36 |
37 | private Jwks() {
38 | }
39 |
40 | public static RSAKey generateRsa() {
41 | KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
42 | RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
43 | RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
44 | // @formatter:off
45 | return new RSAKey.Builder(publicKey)
46 | .privateKey(privateKey)
47 | .keyID(UUID.randomUUID().toString())
48 | .build();
49 | // @formatter:on
50 | }
51 |
52 | public static ECKey generateEc() {
53 | KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
54 | ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
55 | ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
56 | Curve curve = Curve.forECParameterSpec(publicKey.getParams());
57 | // @formatter:off
58 | return new ECKey.Builder(curve, publicKey)
59 | .privateKey(privateKey)
60 | .keyID(UUID.randomUUID().toString())
61 | .build();
62 | // @formatter:on
63 | }
64 |
65 | public static OctetSequenceKey generateSecret() {
66 | SecretKey secretKey = KeyGeneratorUtils.generateSecretKey();
67 | // @formatter:off
68 | return new OctetSequenceKey.Builder(secretKey)
69 | .keyID(UUID.randomUUID().toString())
70 | .build();
71 | // @formatter:on
72 | }
73 | }
74 |
--------------------------------------------------------------------------------
/samples/default-authorizationserver/src/main/java/sample/jose/Jwks.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.jose;
17 |
18 | import java.security.KeyPair;
19 | import java.security.interfaces.ECPrivateKey;
20 | import java.security.interfaces.ECPublicKey;
21 | import java.security.interfaces.RSAPrivateKey;
22 | import java.security.interfaces.RSAPublicKey;
23 | import java.util.UUID;
24 |
25 | import javax.crypto.SecretKey;
26 |
27 | import com.nimbusds.jose.jwk.Curve;
28 | import com.nimbusds.jose.jwk.ECKey;
29 | import com.nimbusds.jose.jwk.OctetSequenceKey;
30 | import com.nimbusds.jose.jwk.RSAKey;
31 |
32 | /**
33 | * @author Joe Grandja
34 | * @since 0.1.0
35 | */
36 | public final class Jwks {
37 |
38 | private Jwks() {
39 | }
40 |
41 | public static RSAKey generateRsa() {
42 | KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
43 | RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
44 | RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
45 | // @formatter:off
46 | return new RSAKey.Builder(publicKey)
47 | .privateKey(privateKey)
48 | .keyID(UUID.randomUUID().toString())
49 | .build();
50 | // @formatter:on
51 | }
52 |
53 | public static ECKey generateEc() {
54 | KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
55 | ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
56 | ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
57 | Curve curve = Curve.forECParameterSpec(publicKey.getParams());
58 | // @formatter:off
59 | return new ECKey.Builder(curve, publicKey)
60 | .privateKey(privateKey)
61 | .keyID(UUID.randomUUID().toString())
62 | .build();
63 | // @formatter:on
64 | }
65 |
66 | public static OctetSequenceKey generateSecret() {
67 | SecretKey secretKey = KeyGeneratorUtils.generateSecretKey();
68 | // @formatter:off
69 | return new OctetSequenceKey.Builder(secretKey)
70 | .keyID(UUID.randomUUID().toString())
71 | .build();
72 | // @formatter:on
73 | }
74 | }
75 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcProviderMetadataClaimAccessor.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.core.oidc;
17 |
18 |
19 | import java.util.List;
20 |
21 | import org.springframework.security.oauth2.core.ClaimAccessor;
22 | import org.springframework.security.oauth2.core.OAuth2AuthorizationServerMetadataClaimAccessor;
23 | import org.springframework.security.oauth2.jose.jws.JwsAlgorithm;
24 | import org.springframework.security.oauth2.jwt.Jwt;
25 |
26 | /**
27 | * A {@link ClaimAccessor} for the "claims" that can be returned
28 | * in the OpenID Provider Configuration Response.
29 | *
30 | * @author Daniel Garnier-Moiroux
31 | * @since 0.1.0
32 | * @see ClaimAccessor
33 | * @see OAuth2AuthorizationServerMetadataClaimAccessor
34 | * @see OidcProviderMetadataClaimNames
35 | * @see OidcProviderConfiguration
36 | * @see 3. OpenID Provider Metadata
37 | */
38 | public interface OidcProviderMetadataClaimAccessor extends OAuth2AuthorizationServerMetadataClaimAccessor {
39 |
40 | /**
41 | * Returns the Subject Identifier types supported {@code (subject_types_supported)}.
42 | *
43 | * @return the Subject Identifier types supported
44 | */
45 | default List getSubjectTypes() {
46 | return getClaimAsStringList(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED);
47 | }
48 |
49 | /**
50 | * Returns the {@link JwsAlgorithm JWS} signing algorithms supported for the {@link OidcIdToken ID Token}
51 | * to encode the claims in a {@link Jwt} {@code (id_token_signing_alg_values_supported)}.
52 | *
53 | * @return the {@link JwsAlgorithm JWS} signing algorithms supported for the {@link OidcIdToken ID Token}
54 | */
55 | default List getIdTokenSigningAlgorithms() {
56 | return getClaimAsStringList(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
57 | }
58 |
59 | }
60 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/http/converter/HttpMessageConverters.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2002-2018 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.core.oidc.http.converter;
17 |
18 | import org.springframework.http.converter.GenericHttpMessageConverter;
19 | import org.springframework.http.converter.HttpMessageConverter;
20 | import org.springframework.http.converter.json.GsonHttpMessageConverter;
21 | import org.springframework.http.converter.json.JsonbHttpMessageConverter;
22 | import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
23 | import org.springframework.util.ClassUtils;
24 |
25 | /**
26 | * TODO
27 | * This class is a straight copy from Spring Security.
28 | * It should be consolidated when merging this codebase into Spring Security.
29 | *
30 | * Utility methods for {@link HttpMessageConverter}'s.
31 | *
32 | * @author Joe Grandja
33 | * @since 5.1
34 | */
35 | final class HttpMessageConverters {
36 |
37 | private static final boolean jackson2Present;
38 |
39 | private static final boolean gsonPresent;
40 |
41 | private static final boolean jsonbPresent;
42 |
43 | static {
44 | ClassLoader classLoader = HttpMessageConverters.class.getClassLoader();
45 | jackson2Present = ClassUtils.isPresent("com.fasterxml.jackson.databind.ObjectMapper", classLoader)
46 | && ClassUtils.isPresent("com.fasterxml.jackson.core.JsonGenerator", classLoader);
47 | gsonPresent = ClassUtils.isPresent("com.google.gson.Gson", classLoader);
48 | jsonbPresent = ClassUtils.isPresent("javax.json.bind.Jsonb", classLoader);
49 | }
50 |
51 | private HttpMessageConverters() {
52 | }
53 |
54 | static GenericHttpMessageConverter