23 |
24 |
25 |
26 |
27 |
28 |
--------------------------------------------------------------------------------
/docs/src/main/java/sample/jpa/repository/authorizationconsent/AuthorizationConsentRepository.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.jpa.repository.authorizationconsent;
17 |
18 | import java.util.Optional;
19 |
20 | import sample.jpa.entity.authorizationconsent.AuthorizationConsent;
21 |
22 | import org.springframework.data.jpa.repository.JpaRepository;
23 | import org.springframework.stereotype.Repository;
24 |
25 | @Repository
26 | public interface AuthorizationConsentRepository extends JpaRepository {
27 | Optional findByRegisteredClientIdAndPrincipalName(String registeredClientId, String principalName);
28 | void deleteByRegisteredClientIdAndPrincipalName(String registeredClientId, String principalName);
29 | }
30 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/util/SpringAuthorizationServerVersion.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.util;
17 |
18 | /**
19 | * Internal class used for serialization across Spring Authorization Server classes.
20 | *
21 | * @author Anoop Garlapati
22 | * @since 0.0.1
23 | */
24 | public final class SpringAuthorizationServerVersion {
25 | private static final int MAJOR = 1;
26 | private static final int MINOR = 3;
27 | private static final int PATCH = 0;
28 |
29 | /**
30 | * Global Serialization value for Spring Authorization Server classes.
31 | */
32 | public static final long SERIAL_VERSION_UID = getVersion().hashCode();
33 |
34 | public static String getVersion() {
35 | return MAJOR + "." + MINOR + "." + PATCH;
36 | }
37 | }
38 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/OAuth2TokenCustomizer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.token;
17 |
18 | /**
19 | * Implementations of this interface are responsible for customizing the
20 | * OAuth 2.0 Token attributes contained within the {@link OAuth2TokenContext}.
21 | *
22 | * @author Joe Grandja
23 | * @since 0.1.0
24 | * @see OAuth2TokenContext
25 | * @param the type of the context containing the OAuth 2.0 Token attributes
26 | */
27 | @FunctionalInterface
28 | public interface OAuth2TokenCustomizer {
29 |
30 | /**
31 | * Customize the OAuth 2.0 Token attributes.
32 | *
33 | * @param context the context containing the OAuth 2.0 Token attributes
34 | */
35 | void customize(T context);
36 |
37 | }
38 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/JwsAlgorithmMixin.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.jackson2;
17 |
18 | import com.fasterxml.jackson.annotation.JsonAutoDetect;
19 | import com.fasterxml.jackson.annotation.JsonTypeInfo;
20 |
21 | import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
22 |
23 | /**
24 | * This mixin class is used to serialize/deserialize {@link SignatureAlgorithm}.
25 | *
26 | * @author Joe Grandja
27 | * @since 0.1.2
28 | * @see SignatureAlgorithm
29 | */
30 | @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
31 | @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
32 | isGetterVisibility = JsonAutoDetect.Visibility.NONE)
33 | abstract class JwsAlgorithmMixin {
34 | }
35 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/spring-security-oauth2-authorization-server.gradle:
--------------------------------------------------------------------------------
1 | plugins {
2 | id "io.spring.convention.spring-module"
3 | }
4 |
5 | dependencies {
6 | management platform(project(":spring-authorization-server-dependencies"))
7 |
8 | api "org.springframework.security:spring-security-config"
9 | api "org.springframework.security:spring-security-web"
10 | api "org.springframework.security:spring-security-oauth2-core"
11 | api "org.springframework.security:spring-security-oauth2-jose"
12 | api "org.springframework.security:spring-security-oauth2-resource-server"
13 | api("org.springframework:spring-core") {
14 | exclude group: "commons-logging", module: "commons-logging"
15 | }
16 | api "com.nimbusds:nimbus-jose-jwt"
17 | api "com.fasterxml.jackson.core:jackson-databind"
18 |
19 | optional "com.fasterxml.jackson.datatype:jackson-datatype-jsr310"
20 | optional "org.springframework:spring-jdbc"
21 |
22 | testImplementation "org.springframework.security:spring-security-test"
23 | testImplementation "org.springframework:spring-webmvc"
24 | testImplementation "org.bouncycastle:bcpkix-jdk18on"
25 | testImplementation "org.bouncycastle:bcprov-jdk18on"
26 | testImplementation "org.junit.jupiter:junit-jupiter"
27 | testImplementation "org.assertj:assertj-core"
28 | testImplementation "org.mockito:mockito-core"
29 | testImplementation "com.jayway.jsonpath:json-path"
30 | testImplementation "com.squareup.okhttp3:mockwebserver"
31 |
32 | testRuntimeOnly "org.hsqldb:hsqldb"
33 |
34 | provided "jakarta.servlet:jakarta.servlet-api"
35 | }
36 |
--------------------------------------------------------------------------------
/samples/x509-certificate-generator/generated/spring-samples-ca.pem:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE-----
2 | MIIEBjCCAu6gAwIBAgIIpMf6rDm8a1IwDQYJKoZIhvcNAQELBQAwWzELMAkGA1UE
3 | BhMCVVMxDzANBgNVBAoTBlNwcmluZzEXMBUGA1UECxMOU3ByaW5nIFNhbXBsZXMx
4 | IjAgBgNVBAMTGXNwcmluZy1zYW1wbGVzLXRydXN0ZWQtY2EwHhcNMjQwNDAyMTAy
5 | MDE2WhcNMjUwNDAyMTAyMDE2WjBTMQswCQYDVQQGEwJVUzEPMA0GA1UEChMGU3By
6 | aW5nMRcwFQYDVQQLEw5TcHJpbmcgU2FtcGxlczEaMBgGA1UEAxMRc3ByaW5nLXNh
7 | bXBsZXMtY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgOMG5PXY+
8 | jOUp07/wltx0bPN4JiFhCcK35fE6nzxBQJ/gtR6djAjrEOtJh5uJB8k7kF9bKMU3
9 | Eb3kBwO/vR6pemKVUMFA1wyMthnrR36D+Q2MwhWG6BGGTkQ9GSBv6JSWZtQeJBHT
10 | P6XFsbtMySFSamqdTnXjspv4hVAs/gNYyHoAfR67I0L1mSdlnHo2R48+eYA+7Kqt
11 | d4IuW/nJY4ZCYNksOEemhY2ck7VGmd87PgwibXLVmbUob7UOdn4j7x4rqUgaHl83
12 | eBnu6W+xYTM1Cjc/jITMf3dXejEr9/68CNIxlnB02cZnr1JE6Bw6yIFMcrNaCYOd
13 | ODt4zaViZBzRAgMBAAGjgdUwgdIwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8B
14 | Af8EBAMCAQYwgYwGA1UdIwSBhDCBgYAUmJZhDGV3S/o2ifi1PP+NK/oEnO6hX6Rd
15 | MFsxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZTcHJpbmcxFzAVBgNVBAsTDlNwcmlu
16 | ZyBTYW1wbGVzMSIwIAYDVQQDExlzcHJpbmctc2FtcGxlcy10cnVzdGVkLWNhgghC
17 | rW20bQfpBzAdBgNVHQ4EFgQUbTwdOttQ8rYcCuW95y5ZEdW0CsEwDQYJKoZIhvcN
18 | AQELBQADggEBAKW0Z0oq+jGvjfrKhxqxW3mfEZT+rrjkZXXC0f4YtH5HhddM/Jk/
19 | kB3p3OWoUS1b9F/jkFVZjihL7iKhpy8XvukRI6cm5PNbY9PN0hzmf0dg+3W61R1Q
20 | DB0rAJMGmhMw7j6mpZVcZS15gxP3pR/4JCM2xjDrpgGmwAJDPLD2b2tTX5Zr66mF
21 | fZ0pl414990wBwDDPi+vlJ345fcwATvLeYxLykXCpCiLDziW81PZ/NnMXhfL75QB
22 | Z9Pfg9Ose2esdJ+FOYPhZr85BQxS46DBtAsUZHjQXBO7/xbahv3euKV0jlJkzkre
23 | fqMfdOOCBi7vUpqCW7c0n2cIEwJiqO0HGU4=
24 | -----END CERTIFICATE-----
25 |
--------------------------------------------------------------------------------
/settings.gradle:
--------------------------------------------------------------------------------
1 | pluginManagement {
2 | repositories {
3 | gradlePluginPortal()
4 | }
5 | }
6 |
7 | plugins {
8 | id "com.gradle.enterprise" version "3.16.2"
9 | id "io.spring.ge.conventions" version "0.0.15"
10 | }
11 |
12 | dependencyResolutionManagement {
13 | repositories {
14 | mavenCentral()
15 | }
16 | }
17 |
18 | rootProject.name = "spring-authorization-server"
19 |
20 | def buildFiles = fileTree(rootDir) {
21 | def excludes = gradle.startParameter.projectProperties.get("excludeProjects")?.split(",")
22 | include "**/*.gradle", "**/*.gradle.kts"
23 | exclude "build", "**/gradle", "settings.gradle", "buildSrc", "/build.gradle", ".*", "out"
24 | if (excludes) {
25 | exclude excludes
26 | }
27 | }
28 |
29 | buildFiles.forEach { buildFile ->
30 | def isDefaultName = buildFile.name == "build.gradle" || buildFile.name == "build.gradle.kts"
31 | def isKotlin = buildFile.name.endsWith ".kts"
32 | if (isDefaultName) {
33 | def buildFilePath = buildFile.parentFile.absolutePath
34 | def projectPath = buildFilePath.replace((String) rootDir.absolutePath, "").replace(File.separator, ":")
35 | include projectPath
36 | } else {
37 | def projectName
38 | if (isKotlin) {
39 | projectName = buildFile.name.replace(".gradle.kts", "")
40 | } else {
41 | projectName = buildFile.name.replace(".gradle", "")
42 | }
43 |
44 |
45 | def projectPath = ":$projectName"
46 | include projectPath
47 |
48 | def project = findProject(projectPath)
49 | project.name = projectName
50 | project.projectDir = buildFile.parentFile
51 | project.buildFileName = buildFile.name
52 | }
53 | }
54 |
--------------------------------------------------------------------------------
/docs/src/main/java/sample/customclaims/CustomClaimsConfiguration.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.customclaims;
17 |
18 | import org.springframework.context.annotation.Bean;
19 | import org.springframework.context.annotation.Configuration;
20 | import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
21 | import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
22 | import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
23 |
24 | @Configuration
25 | public class CustomClaimsConfiguration {
26 | @Bean
27 | public OAuth2TokenCustomizer jwtTokenCustomizer() {
28 | return (context) -> {
29 | if (OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())) {
30 | context.getClaims().claims((claims) -> {
31 | claims.put("claim-1", "value-1");
32 | claims.put("claim-2", "value-2");
33 | });
34 | }
35 | };
36 | }
37 | }
38 |
--------------------------------------------------------------------------------
/docs/modules/ROOT/pages/getting-help.adoc:
--------------------------------------------------------------------------------
1 | [[getting-help]]
2 | = Getting Help
3 | :page-section-summary-toc: 1
4 |
5 | [[community]]
6 | == Community
7 |
8 | Welcome to the https://docs.spring.io/spring-security/reference/community.html[Spring Security Community].
9 | Spring Authorization Server is an open source project led by the Spring Security team.
10 | If you need help with Spring Authorization Server, we are here to help.
11 |
12 | [[resources]]
13 | == Resources
14 |
15 | The following are some of the best ways to get help:
16 |
17 | * Try the xref:how-to.adoc[How-to guides]. They provide solutions to the most common questions.
18 | * Learn the Spring Security basics that Spring Authorization Server builds on. If you are starting out with Spring Security, check the https://spring.io/projects/spring-security#learn[reference documentation] or try one of the https://github.com/spring-projects/spring-security-samples[samples].
19 | * Read through xref:index.adoc[this documentation].
20 | * Try one of our many https://github.com/spring-projects/spring-authorization-server/tree/main/samples[sample applications].
21 | * Ask a question on Stack Overflow with the https://stackoverflow.com/questions/tagged/spring-authorization-server[`spring-authorization-server`] tag.
22 | * Report bugs and enhancement requests on https://github.com/spring-projects/spring-authorization-server/issues[GitHub].
23 |
24 | NOTE: Spring Authorization Server is open source, including the documentation. If you find problems with the docs or if you want to improve them, please https://github.com/spring-projects/spring-authorization-server[get involved].
25 |
--------------------------------------------------------------------------------
/samples/demo-authorizationserver/src/main/java/sample/web/DeviceController.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.web;
17 |
18 | import org.springframework.stereotype.Controller;
19 | import org.springframework.web.bind.annotation.GetMapping;
20 | import org.springframework.web.bind.annotation.RequestParam;
21 |
22 | /**
23 | * @author Steve Riesenberg
24 | * @since 1.1
25 | */
26 | @Controller
27 | public class DeviceController {
28 |
29 | @GetMapping("/activate")
30 | public String activate(@RequestParam(value = "user_code", required = false) String userCode) {
31 | if (userCode != null) {
32 | return "redirect:/oauth2/device_verification?user_code=" + userCode;
33 | }
34 | return "device-activate";
35 | }
36 |
37 | @GetMapping("/activated")
38 | public String activated() {
39 | return "device-activated";
40 | }
41 |
42 | @GetMapping(value = "/", params = "success")
43 | public String success() {
44 | return "device-activated";
45 | }
46 |
47 | }
48 |
--------------------------------------------------------------------------------
/docs/src/main/java/sample/userinfo/jwt/JwtTokenCustomizerConfig.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.userinfo.jwt;
17 |
18 | import org.springframework.context.annotation.Bean;
19 | import org.springframework.context.annotation.Configuration;
20 | import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
21 | import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
22 | import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
23 |
24 | @Configuration
25 | public class JwtTokenCustomizerConfig {
26 |
27 | // @formatter:off
28 | @Bean
29 | public OAuth2TokenCustomizer tokenCustomizer() {
30 | return (context) -> {
31 | if (OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())) {
32 | context.getClaims().claims((claims) -> {
33 | claims.put("claim-1", "value-1");
34 | claims.put("claim-2", "value-2");
35 | });
36 | }
37 | };
38 | }
39 | // @formatter:on
40 |
41 | }
42 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/jwt/TestJwtClaimsSets.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.jwt;
17 |
18 | import java.time.Instant;
19 | import java.time.temporal.ChronoUnit;
20 | import java.util.Collections;
21 |
22 | /**
23 | * @author Joe Grandja
24 | */
25 | public final class TestJwtClaimsSets {
26 |
27 | private TestJwtClaimsSets() {
28 | }
29 |
30 | public static JwtClaimsSet.Builder jwtClaimsSet() {
31 | String issuer = "https://provider.com";
32 | Instant issuedAt = Instant.now();
33 | Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);
34 |
35 | // @formatter:off
36 | return JwtClaimsSet.builder()
37 | .issuer(issuer)
38 | .subject("subject")
39 | .audience(Collections.singletonList("client-1"))
40 | .issuedAt(issuedAt)
41 | .notBefore(issuedAt)
42 | .expiresAt(expiresAt)
43 | .id("jti")
44 | .claim("custom-claim-name", "custom-claim-value");
45 | // @formatter:on
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/samples/demo-authorizationserver/src/main/resources/templates/device-activate.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 | Spring Authorization Server sample
7 |
8 |
9 |
10 |
11 |
12 |
13 |
Device Activation
14 |
Enter the activation code to authorize the device.
15 |
16 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
--------------------------------------------------------------------------------
/samples/demo-client/src/main/java/sample/authorization/OAuth2DeviceGrantRequest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.authorization;
17 |
18 | import org.springframework.security.oauth2.client.endpoint.AbstractOAuth2AuthorizationGrantRequest;
19 | import org.springframework.security.oauth2.client.registration.ClientRegistration;
20 | import org.springframework.security.oauth2.core.AuthorizationGrantType;
21 | import org.springframework.util.Assert;
22 |
23 | /**
24 | * @author Steve Riesenberg
25 | * @since 1.1
26 | */
27 | public final class OAuth2DeviceGrantRequest extends AbstractOAuth2AuthorizationGrantRequest {
28 |
29 | private final String deviceCode;
30 |
31 | public OAuth2DeviceGrantRequest(ClientRegistration clientRegistration, String deviceCode) {
32 | super(AuthorizationGrantType.DEVICE_CODE, clientRegistration);
33 | Assert.hasText(deviceCode, "deviceCode cannot be empty");
34 | this.deviceCode = deviceCode;
35 | }
36 |
37 | public String getDeviceCode() {
38 | return this.deviceCode;
39 | }
40 |
41 | }
42 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/UnmodifiableMapMixin.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.jackson2;
17 |
18 | import java.util.Collections;
19 | import java.util.Map;
20 |
21 | import com.fasterxml.jackson.annotation.JsonCreator;
22 | import com.fasterxml.jackson.annotation.JsonTypeInfo;
23 | import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
24 |
25 | /**
26 | * This mixin class is used to serialize/deserialize
27 | * {@link Collections#unmodifiableMap(Map)}. It also registers a custom deserializer
28 | * {@link UnmodifiableMapDeserializer}.
29 | *
30 | * @author Joe Grandja
31 | * @since 0.1.2
32 | * @see Collections#unmodifiableMap(Map)
33 | * @see UnmodifiableMapDeserializer
34 | */
35 | @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
36 | @JsonDeserialize(using = UnmodifiableMapDeserializer.class)
37 | abstract class UnmodifiableMapMixin {
38 |
39 | @JsonCreator
40 | UnmodifiableMapMixin(Map map) {
41 | }
42 |
43 | }
44 |
--------------------------------------------------------------------------------
/samples/demo-authorizationserver/src/main/resources/application.yml:
--------------------------------------------------------------------------------
1 | server:
2 | port: 9443
3 | ssl:
4 | bundle: demo-authorizationserver
5 | client-auth: want
6 |
7 | spring:
8 | ssl:
9 | bundle:
10 | jks:
11 | demo-authorizationserver:
12 | key:
13 | alias: demo-authorizationserver-sample
14 | password: password
15 | keystore:
16 | location: classpath:keystore.p12
17 | password: password
18 | type: PKCS12
19 | truststore:
20 | location: classpath:keystore.p12
21 | password: password
22 | type: PKCS12
23 | security:
24 | oauth2:
25 | client:
26 | registration:
27 | google-idp:
28 | provider: google
29 | client-id: ${GOOGLE_CLIENT_ID:google-client-id}
30 | client-secret: ${GOOGLE_CLIENT_SECRET:google-client-secret}
31 | scope: openid, https://www.googleapis.com/auth/userinfo.profile, https://www.googleapis.com/auth/userinfo.email
32 | client-name: Sign in with Google
33 | github-idp:
34 | provider: github
35 | client-id: ${GITHUB_CLIENT_ID:github-client-id}
36 | client-secret: ${GITHUB_CLIENT_SECRET:github-client-secret}
37 | scope: user:email, read:user
38 | client-name: Sign in with GitHub
39 | provider:
40 | google:
41 | user-name-attribute: email
42 | github:
43 | user-name-attribute: login
44 |
45 | logging:
46 | level:
47 | root: INFO
48 | org.springframework.web: INFO
49 | org.springframework.security: INFO
50 | org.springframework.security.oauth2: INFO
51 |
--------------------------------------------------------------------------------
/docs/src/main/java/sample/extgrant/CustomCodeGrantAuthenticationToken.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.extgrant;
17 |
18 | import java.util.Map;
19 |
20 | import org.springframework.lang.Nullable;
21 | import org.springframework.security.core.Authentication;
22 | import org.springframework.security.oauth2.core.AuthorizationGrantType;
23 | import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationGrantAuthenticationToken;
24 | import org.springframework.util.Assert;
25 |
26 | public class CustomCodeGrantAuthenticationToken extends OAuth2AuthorizationGrantAuthenticationToken {
27 | private final String code;
28 |
29 | public CustomCodeGrantAuthenticationToken(String code, Authentication clientPrincipal,
30 | @Nullable Map additionalParameters) {
31 | super(new AuthorizationGrantType("urn:ietf:params:oauth:grant-type:custom_code"),
32 | clientPrincipal, additionalParameters);
33 | Assert.hasText(code, "code cannot be empty");
34 | this.code = code;
35 | }
36 |
37 | public String getCode() {
38 | return this.code;
39 | }
40 |
41 | }
42 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/OAuth2TokenFormatMixin.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.jackson2;
17 |
18 | import com.fasterxml.jackson.annotation.JsonAutoDetect;
19 | import com.fasterxml.jackson.annotation.JsonCreator;
20 | import com.fasterxml.jackson.annotation.JsonProperty;
21 | import com.fasterxml.jackson.annotation.JsonTypeInfo;
22 |
23 | import org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat;
24 |
25 | /**
26 | * This mixin class is used to serialize/deserialize {@link OAuth2TokenFormat}.
27 | *
28 | * @author Joe Grandja
29 | * @since 0.2.3
30 | * @see OAuth2TokenFormat
31 | */
32 | @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
33 | @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
34 | isGetterVisibility = JsonAutoDetect.Visibility.NONE)
35 | abstract class OAuth2TokenFormatMixin {
36 |
37 | @JsonCreator
38 | OAuth2TokenFormatMixin(@JsonProperty("value") String value) {
39 | }
40 |
41 | }
42 |
--------------------------------------------------------------------------------
/samples/messages-resource/src/main/java/sample/config/TomcatServerConfig.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2024 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.config;
17 |
18 | import org.apache.catalina.connector.Connector;
19 |
20 | import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
21 | import org.springframework.boot.web.server.WebServerFactoryCustomizer;
22 | import org.springframework.context.annotation.Bean;
23 | import org.springframework.context.annotation.Configuration;
24 |
25 | /**
26 | * @author Joe Grandja
27 | * @since 1.3
28 | */
29 | @Configuration(proxyBeanMethods = false)
30 | public class TomcatServerConfig {
31 |
32 | @Bean
33 | public WebServerFactoryCustomizer connectorCustomizer() {
34 | return (tomcat) -> tomcat.addAdditionalTomcatConnectors(createHttpConnector());
35 | }
36 |
37 | private Connector createHttpConnector() {
38 | Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
39 | connector.setScheme("http");
40 | connector.setPort(8090);
41 | connector.setSecure(false);
42 | connector.setRedirectPort(8443);
43 | return connector;
44 | }
45 |
46 | }
47 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/OAuth2AuthorizationCode.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization;
17 |
18 | import java.time.Instant;
19 |
20 | import org.springframework.security.oauth2.core.AbstractOAuth2Token;
21 |
22 | /**
23 | * An implementation of an {@link AbstractOAuth2Token}
24 | * representing an OAuth 2.0 Authorization Code Grant.
25 | *
26 | * @author Joe Grandja
27 | * @since 0.0.3
28 | * @see AbstractOAuth2Token
29 | * @see Section 4.1 Authorization Code Grant
30 | */
31 | public class OAuth2AuthorizationCode extends AbstractOAuth2Token {
32 |
33 | /**
34 | * Constructs an {@code OAuth2AuthorizationCode} using the provided parameters.
35 | * @param tokenValue the token value
36 | * @param issuedAt the time at which the token was issued
37 | * @param expiresAt the time at which the token expires
38 | */
39 | public OAuth2AuthorizationCode(String tokenValue, Instant issuedAt, Instant expiresAt) {
40 | super(tokenValue, issuedAt, expiresAt);
41 | }
42 |
43 | }
44 |
--------------------------------------------------------------------------------
/docs/src/main/java/sample/userinfo/idtoken/IdTokenCustomizerConfig.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.userinfo.idtoken;
17 |
18 | import org.springframework.context.annotation.Bean;
19 | import org.springframework.context.annotation.Configuration;
20 | import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
21 | import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames;
22 | import org.springframework.security.oauth2.server.authorization.token.JwtEncodingContext;
23 | import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
24 |
25 | @Configuration
26 | public class IdTokenCustomizerConfig {
27 |
28 | // @formatter:off
29 | @Bean // <1>
30 | public OAuth2TokenCustomizer tokenCustomizer(
31 | OidcUserInfoService userInfoService) {
32 | return (context) -> {
33 | if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())) {
34 | OidcUserInfo userInfo = userInfoService.loadUser( // <2>
35 | context.getPrincipal().getName());
36 | context.getClaims().claims(claims ->
37 | claims.putAll(userInfo.getClaims()));
38 | }
39 | };
40 | }
41 | // @formatter:on
42 |
43 | }
44 |
--------------------------------------------------------------------------------
/etc/checkstyle/checkstyle.xml:
--------------------------------------------------------------------------------
1 |
2 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeActorTests.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2024 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.authentication;
17 |
18 | import java.util.Map;
19 |
20 | import org.junit.jupiter.api.Test;
21 |
22 | import static org.assertj.core.api.Assertions.assertThat;
23 | import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
24 |
25 | /**
26 | * Tests for {@link OAuth2TokenExchangeActor}.
27 | *
28 | * @author Steve Riesenberg
29 | */
30 | public class OAuth2TokenExchangeActorTests {
31 |
32 | @Test
33 | public void constructorWhenClaimsNullThenThrowIllegalArgumentException() {
34 | // @formatter:off
35 | assertThatIllegalArgumentException()
36 | .isThrownBy(() -> new OAuth2TokenExchangeActor(null))
37 | .withMessage("claims cannot be null");
38 | // @formatter:on
39 | }
40 |
41 | @Test
42 | public void constructorWhenRequiredParametersThenCreated() {
43 | Map claims = Map.of("claim1", "value1");
44 | OAuth2TokenExchangeActor actor = new OAuth2TokenExchangeActor(claims);
45 | assertThat(actor.getClaims()).isEqualTo(claims);
46 | }
47 |
48 | }
49 |
--------------------------------------------------------------------------------
/samples/users-resource/src/main/java/sample/config/SecurityConfig.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2024 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.config;
17 |
18 | import org.springframework.context.annotation.Bean;
19 | import org.springframework.context.annotation.Configuration;
20 | import org.springframework.security.config.Customizer;
21 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
22 | import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
23 | import org.springframework.security.web.SecurityFilterChain;
24 |
25 | /**
26 | * @author Steve Riesenberg
27 | * @since 1.3
28 | */
29 | @Configuration
30 | @EnableWebSecurity
31 | public class SecurityConfig {
32 |
33 | @Bean
34 | public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
35 | // @formatter:off
36 | http
37 | .securityMatcher("/user/**")
38 | .authorizeHttpRequests((authorize) -> authorize
39 | .requestMatchers("/user/**").hasAuthority("SCOPE_user.read")
40 | )
41 | .oauth2ResourceServer((oauth2ResourceServer) -> oauth2ResourceServer
42 | .jwt(Customizer.withDefaults())
43 | )
44 | .oauth2Client(Customizer.withDefaults());
45 | // @formatter:on
46 |
47 | return http.build();
48 | }
49 |
50 | }
51 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/resources/org/springframework/security/oauth2/server/authorization/custom-oauth2-authorization-schema.sql:
--------------------------------------------------------------------------------
1 | CREATE TABLE oauth2Authorization (
2 | id varchar(100) NOT NULL,
3 | registeredClientId varchar(100) NOT NULL,
4 | principalName varchar(200) NOT NULL,
5 | authorizationGrantType varchar(100) NOT NULL,
6 | authorizedScopes varchar(1000) DEFAULT NULL,
7 | attributes varchar(4000) DEFAULT NULL,
8 | state varchar(500) DEFAULT NULL,
9 | authorizationCodeValue varchar(1000) DEFAULT NULL,
10 | authorizationCodeIssuedAt timestamp DEFAULT NULL,
11 | authorizationCodeExpiresAt timestamp DEFAULT NULL,
12 | authorizationCodeMetadata varchar(2000) DEFAULT NULL,
13 | accessTokenValue varchar(1000) DEFAULT NULL,
14 | accessTokenIssuedAt timestamp DEFAULT NULL,
15 | accessTokenExpiresAt timestamp DEFAULT NULL,
16 | accessTokenMetadata varchar(2000) DEFAULT NULL,
17 | accessTokenType varchar(100) DEFAULT NULL,
18 | accessTokenScopes varchar(1000) DEFAULT NULL,
19 | oidcIdTokenValue varchar(1000) DEFAULT NULL,
20 | oidcIdTokenIssuedAt timestamp DEFAULT NULL,
21 | oidcIdTokenExpiresAt timestamp DEFAULT NULL,
22 | oidcIdTokenMetadata varchar(2000) DEFAULT NULL,
23 | refreshTokenValue varchar(1000) DEFAULT NULL,
24 | refreshTokenIssuedAt timestamp DEFAULT NULL,
25 | refreshTokenExpiresAt timestamp DEFAULT NULL,
26 | refreshTokenMetadata varchar(2000) DEFAULT NULL,
27 | userCodeValue varchar(1000) DEFAULT NULL,
28 | userCodeIssuedAt timestamp DEFAULT NULL,
29 | userCodeExpiresAt timestamp DEFAULT NULL,
30 | userCodeMetadata varchar(2000) DEFAULT NULL,
31 | deviceCodeValue varchar(1000) DEFAULT NULL,
32 | deviceCodeIssuedAt timestamp DEFAULT NULL,
33 | deviceCodeExpiresAt timestamp DEFAULT NULL,
34 | deviceCodeMetadata varchar(2000) DEFAULT NULL,
35 | PRIMARY KEY (id)
36 | );
37 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/resources/org/springframework/security/oauth2/server/authorization/custom-oauth2-authorization-schema-clob-data-type.sql:
--------------------------------------------------------------------------------
1 | CREATE TABLE oauth2_authorization (
2 | id varchar(100) NOT NULL,
3 | registered_client_id varchar(100) NOT NULL,
4 | principal_name varchar(200) NOT NULL,
5 | authorization_grant_type varchar(100) NOT NULL,
6 | authorized_scopes varchar(1000) DEFAULT NULL,
7 | attributes varchar(4000) DEFAULT NULL,
8 | state varchar(500) DEFAULT NULL,
9 | authorization_code_value clob DEFAULT NULL,
10 | authorization_code_issued_at timestamp DEFAULT NULL,
11 | authorization_code_expires_at timestamp DEFAULT NULL,
12 | authorization_code_metadata varchar(2000) DEFAULT NULL,
13 | access_token_value clob DEFAULT NULL,
14 | access_token_issued_at timestamp DEFAULT NULL,
15 | access_token_expires_at timestamp DEFAULT NULL,
16 | access_token_metadata varchar(2000) DEFAULT NULL,
17 | access_token_type varchar(100) DEFAULT NULL,
18 | access_token_scopes varchar(1000) DEFAULT NULL,
19 | oidc_id_token_value clob DEFAULT NULL,
20 | oidc_id_token_issued_at timestamp DEFAULT NULL,
21 | oidc_id_token_expires_at timestamp DEFAULT NULL,
22 | oidc_id_token_metadata varchar(2000) DEFAULT NULL,
23 | refresh_token_value clob DEFAULT NULL,
24 | refresh_token_issued_at timestamp DEFAULT NULL,
25 | refresh_token_expires_at timestamp DEFAULT NULL,
26 | refresh_token_metadata varchar(2000) DEFAULT NULL,
27 | user_code_value clob DEFAULT NULL,
28 | user_code_issued_at timestamp DEFAULT NULL,
29 | user_code_expires_at timestamp DEFAULT NULL,
30 | user_code_metadata varchar(2000) DEFAULT NULL,
31 | device_code_value clob DEFAULT NULL,
32 | device_code_issued_at timestamp DEFAULT NULL,
33 | device_code_expires_at timestamp DEFAULT NULL,
34 | device_code_metadata varchar(2000) DEFAULT NULL,
35 | PRIMARY KEY (id)
36 | );
37 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/context/TestAuthorizationServerContext.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.context;
17 |
18 | import java.util.function.Supplier;
19 |
20 | import org.springframework.lang.Nullable;
21 | import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
22 |
23 | /**
24 | * @author Joe Grandja
25 | */
26 | public class TestAuthorizationServerContext implements AuthorizationServerContext {
27 | private final AuthorizationServerSettings authorizationServerSettings;
28 | private final Supplier issuerSupplier;
29 |
30 | public TestAuthorizationServerContext(AuthorizationServerSettings authorizationServerSettings, @Nullable Supplier issuerSupplier) {
31 | this.authorizationServerSettings = authorizationServerSettings;
32 | this.issuerSupplier = issuerSupplier;
33 | }
34 |
35 | @Override
36 | public String getIssuer() {
37 | return this.issuerSupplier != null ?
38 | this.issuerSupplier.get() :
39 | getAuthorizationServerSettings().getIssuer();
40 | }
41 |
42 | @Override
43 | public AuthorizationServerSettings getAuthorizationServerSettings() {
44 | return this.authorizationServerSettings;
45 | }
46 |
47 | }
48 |
--------------------------------------------------------------------------------
/samples/demo-authorizationserver/src/main/java/sample/config/TomcatServerConfig.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2024 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.config;
17 |
18 | import org.apache.catalina.connector.Connector;
19 |
20 | import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
21 | import org.springframework.boot.web.server.WebServerFactoryCustomizer;
22 | import org.springframework.context.annotation.Bean;
23 | import org.springframework.context.annotation.Configuration;
24 | import org.springframework.context.annotation.Profile;
25 |
26 | /**
27 | * @author Joe Grandja
28 | * @since 1.3
29 | */
30 | @Profile("!test") // Exclude this from DemoAuthorizationServerApplicationTests and DemoAuthorizationServerConsentTests
31 | @Configuration(proxyBeanMethods = false)
32 | public class TomcatServerConfig {
33 |
34 | @Bean
35 | public WebServerFactoryCustomizer connectorCustomizer() {
36 | return (tomcat) -> tomcat.addAdditionalTomcatConnectors(createHttpConnector());
37 | }
38 |
39 | private Connector createHttpConnector() {
40 | Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
41 | connector.setScheme("http");
42 | connector.setPort(9000);
43 | connector.setSecure(false);
44 | connector.setRedirectPort(9443);
45 | return connector;
46 | }
47 |
48 | }
49 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configuration/OAuth2AuthorizationServerConfigurationTests.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration;
17 |
18 | import java.lang.reflect.Method;
19 |
20 | import org.junit.jupiter.api.Test;
21 |
22 | import org.springframework.core.Ordered;
23 | import org.springframework.core.annotation.OrderUtils;
24 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
25 | import org.springframework.util.ClassUtils;
26 |
27 | import static org.assertj.core.api.Assertions.assertThat;
28 |
29 | /**
30 | * Tests for {@link OAuth2AuthorizationServerConfiguration}.
31 | *
32 | * @author Joe Grandja
33 | */
34 | public class OAuth2AuthorizationServerConfigurationTests {
35 |
36 | @Test
37 | public void assertOrderHighestPrecedence() {
38 | Method authorizationServerSecurityFilterChainMethod =
39 | ClassUtils.getMethod(
40 | OAuth2AuthorizationServerConfiguration.class,
41 | "authorizationServerSecurityFilterChain",
42 | HttpSecurity.class);
43 | Integer order = OrderUtils.getOrder(authorizationServerSecurityFilterChainMethod);
44 | assertThat(order).isEqualTo(Ordered.HIGHEST_PRECEDENCE);
45 | }
46 |
47 | }
48 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/OAuth2AuthorizationRequestMixin.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.jackson2;
17 |
18 | import com.fasterxml.jackson.annotation.JsonAutoDetect;
19 | import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
20 | import com.fasterxml.jackson.annotation.JsonTypeInfo;
21 | import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
22 |
23 | import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
24 |
25 | /**
26 | * This mixin class is used to serialize/deserialize {@link OAuth2AuthorizationRequest}.
27 | * It also registers a custom deserializer {@link OAuth2AuthorizationRequestDeserializer}.
28 | *
29 | * @author Joe Grandja
30 | * @since 0.1.2
31 | * @see OAuth2AuthorizationRequest
32 | * @see OAuth2AuthorizationRequestDeserializer
33 | */
34 | @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
35 | @JsonDeserialize(using = OAuth2AuthorizationRequestDeserializer.class)
36 | @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
37 | isGetterVisibility = JsonAutoDetect.Visibility.NONE)
38 | @JsonIgnoreProperties(ignoreUnknown = true)
39 | abstract class OAuth2AuthorizationRequestMixin {
40 |
41 | }
42 |
--------------------------------------------------------------------------------
/samples/demo-authorizationserver/src/main/java/sample/authentication/DeviceClientAuthenticationToken.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2023 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package sample.authentication;
17 |
18 | import java.util.Map;
19 |
20 | import org.springframework.lang.Nullable;
21 | import org.springframework.security.core.Transient;
22 | import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
23 | import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
24 | import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
25 |
26 | /**
27 | * @author Joe Grandja
28 | * @author Steve Riesenberg
29 | * @since 1.1
30 | */
31 | @Transient
32 | public class DeviceClientAuthenticationToken extends OAuth2ClientAuthenticationToken {
33 |
34 | public DeviceClientAuthenticationToken(String clientId, ClientAuthenticationMethod clientAuthenticationMethod,
35 | @Nullable Object credentials, @Nullable Map additionalParameters) {
36 | super(clientId, clientAuthenticationMethod, credentials, additionalParameters);
37 | }
38 |
39 | public DeviceClientAuthenticationToken(RegisteredClient registeredClient, ClientAuthenticationMethod clientAuthenticationMethod,
40 | @Nullable Object credentials) {
41 | super(registeredClient, clientAuthenticationMethod, credentials);
42 | }
43 |
44 | }
45 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/DurationMixin.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2021 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.jackson2;
17 |
18 | import java.time.Duration;
19 |
20 | import com.fasterxml.jackson.annotation.JsonAutoDetect;
21 | import com.fasterxml.jackson.annotation.JsonCreator;
22 | import com.fasterxml.jackson.annotation.JsonGetter;
23 | import com.fasterxml.jackson.annotation.JsonProperty;
24 | import com.fasterxml.jackson.annotation.JsonTypeInfo;
25 |
26 | /**
27 | * This mixin class is used to serialize/deserialize {@link Duration}.
28 | *
29 | * @author Joe Grandja
30 | * @since 0.1.2
31 | * @see Duration
32 | */
33 | @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
34 | @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.NONE, getterVisibility = JsonAutoDetect.Visibility.NONE,
35 | isGetterVisibility = JsonAutoDetect.Visibility.NONE, setterVisibility = JsonAutoDetect.Visibility.NONE,
36 | creatorVisibility = JsonAutoDetect.Visibility.NONE)
37 | abstract class DurationMixin {
38 |
39 | @JsonCreator
40 | static void ofSeconds(@JsonProperty("seconds") long seconds, @JsonProperty("nano") long nanoAdjustment) {
41 | }
42 |
43 | @JsonGetter("seconds")
44 | abstract long getSeconds();
45 |
46 | @JsonGetter("nano")
47 | abstract int getNano();
48 |
49 | }
50 |
--------------------------------------------------------------------------------
/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/AbstractOAuth2Configurer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020-2022 the original author or authors.
3 | *
4 | * Licensed under the Apache License, Version 2.0 (the "License");
5 | * you may not use this file except in compliance with the License.
6 | * You may obtain a copy of the License at
7 | *
8 | * https://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS,
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | * See the License for the specific language governing permissions and
14 | * limitations under the License.
15 | */
16 | package org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers;
17 |
18 | import org.springframework.security.config.annotation.ObjectPostProcessor;
19 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
20 | import org.springframework.security.web.util.matcher.RequestMatcher;
21 |
22 | /**
23 | * Base configurer for an OAuth 2.0 component (e.g. protocol endpoint).
24 | *
25 | * @author Joe Grandja
26 | * @since 0.1.2
27 | */
28 | abstract class AbstractOAuth2Configurer {
29 | private final ObjectPostProcessor
21 |