From 0493bbf1d1b967f40cd4b8685d5828f29eaa23aa Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Thu, 29 Jul 2021 15:21:23 -0400 Subject: [PATCH] OAuth2ClientAuthenticationToken supports any type of credentials Closes gh-382 --- .../OAuth2ClientAuthenticationProvider.java | 3 +- .../OAuth2ClientAuthenticationToken.java | 100 +++++++++--------- ...entSecretBasicAuthenticationConverter.java | 2 +- ...ientSecretPostAuthenticationConverter.java | 2 +- .../PublicClientAuthenticationConverter.java | 5 +- .../OAuth2ClientCredentialsGrantTests.java | 7 +- .../JwtEncodingContextTests.java | 4 +- ...h2AccessTokenAuthenticationTokenTests.java | 6 +- ...zationCodeAuthenticationProviderTests.java | 32 ++++-- ...orizationCodeAuthenticationTokenTests.java | 5 +- ...uth2ClientAuthenticationProviderTests.java | 30 +++--- .../OAuth2ClientAuthenticationTokenTests.java | 40 ++----- ...redentialsAuthenticationProviderTests.java | 14 ++- ...ntCredentialsAuthenticationTokenTests.java | 7 +- ...freshTokenAuthenticationProviderTests.java | 35 +++--- ...2RefreshTokenAuthenticationTokenTests.java | 7 +- ...rospectionAuthenticationProviderTests.java | 20 ++-- ...IntrospectionAuthenticationTokenTests.java | 5 +- ...RevocationAuthenticationProviderTests.java | 14 ++- ...kenRevocationAuthenticationTokenTests.java | 6 +- ...OAuth2ClientAuthenticationFilterTests.java | 6 +- .../web/OAuth2TokenEndpointFilterTests.java | 16 ++- ...TokenIntrospectionEndpointFilterTests.java | 4 +- ...th2TokenRevocationEndpointFilterTests.java | 4 +- 24 files changed, 210 insertions(+), 164 deletions(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProvider.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProvider.java index 9d642a60..37da7cab 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProvider.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProvider.java @@ -121,7 +121,8 @@ public final class OAuth2ClientAuthenticationProvider implements AuthenticationP throwInvalidClient(); } - return new OAuth2ClientAuthenticationToken(registeredClient); + return new OAuth2ClientAuthenticationToken(registeredClient, + clientAuthentication.getClientAuthenticationMethod(), clientAuthentication.getCredentials()); } @Override diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationToken.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationToken.java index cf84015f..2c760d63 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationToken.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationToken.java @@ -1,5 +1,5 @@ /* - * Copyright 2020 the original author or authors. + * Copyright 2020-2021 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,6 +15,9 @@ */ package org.springframework.security.oauth2.server.authorization.authentication; +import java.util.Collections; +import java.util.Map; + import org.springframework.lang.Nullable; import org.springframework.security.authentication.AbstractAuthenticationToken; import org.springframework.security.core.Authentication; @@ -23,9 +26,6 @@ import org.springframework.security.oauth2.core.Version; import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.util.Assert; -import java.util.Collections; -import java.util.Map; - /** * An {@link Authentication} implementation used for OAuth 2.0 Client Authentication. * @@ -39,94 +39,90 @@ import java.util.Map; */ public class OAuth2ClientAuthenticationToken extends AbstractAuthenticationToken { private static final long serialVersionUID = Version.SERIAL_VERSION_UID; - private String clientId; - private String clientSecret; - private ClientAuthenticationMethod clientAuthenticationMethod; - private Map additionalParameters; - private RegisteredClient registeredClient; + private final String clientId; + private final RegisteredClient registeredClient; + private final ClientAuthenticationMethod clientAuthenticationMethod; + private final Object credentials; + private final Map additionalParameters; /** * Constructs an {@code OAuth2ClientAuthenticationToken} using the provided parameters. * * @param clientId the client identifier - * @param clientSecret the client secret * @param clientAuthenticationMethod the authentication method used by the client + * @param credentials the client credentials * @param additionalParameters the additional parameters */ - public OAuth2ClientAuthenticationToken(String clientId, String clientSecret, - ClientAuthenticationMethod clientAuthenticationMethod, - @Nullable Map additionalParameters) { - this(clientId, additionalParameters); - Assert.hasText(clientSecret, "clientSecret cannot be empty"); - Assert.notNull(clientAuthenticationMethod, "clientAuthenticationMethod cannot be null"); - this.clientSecret = clientSecret; - this.clientAuthenticationMethod = clientAuthenticationMethod; - } - - /** - * Constructs an {@code OAuth2ClientAuthenticationToken} using the provided parameters. - * - * @param clientId the client identifier - * @param additionalParameters the additional parameters - */ - public OAuth2ClientAuthenticationToken(String clientId, - @Nullable Map additionalParameters) { + public OAuth2ClientAuthenticationToken(String clientId, ClientAuthenticationMethod clientAuthenticationMethod, + @Nullable Object credentials, @Nullable Map additionalParameters) { super(Collections.emptyList()); Assert.hasText(clientId, "clientId cannot be empty"); + Assert.notNull(clientAuthenticationMethod, "clientAuthenticationMethod cannot be null"); this.clientId = clientId; - this.additionalParameters = additionalParameters != null ? - Collections.unmodifiableMap(additionalParameters) : null; - this.clientAuthenticationMethod = ClientAuthenticationMethod.NONE; + this.registeredClient = null; + this.clientAuthenticationMethod = clientAuthenticationMethod; + this.credentials = credentials; + this.additionalParameters = Collections.unmodifiableMap( + additionalParameters != null ? additionalParameters : Collections.emptyMap()); } /** * Constructs an {@code OAuth2ClientAuthenticationToken} using the provided parameters. * - * @param registeredClient the registered client + * @param registeredClient the authenticated registered client + * @param clientAuthenticationMethod the authentication method used by the client + * @param credentials the client credentials */ - public OAuth2ClientAuthenticationToken(RegisteredClient registeredClient) { + public OAuth2ClientAuthenticationToken(RegisteredClient registeredClient, ClientAuthenticationMethod clientAuthenticationMethod, + @Nullable Object credentials) { super(Collections.emptyList()); Assert.notNull(registeredClient, "registeredClient cannot be null"); + Assert.notNull(clientAuthenticationMethod, "clientAuthenticationMethod cannot be null"); + this.clientId = registeredClient.getClientId(); this.registeredClient = registeredClient; + this.clientAuthenticationMethod = clientAuthenticationMethod; + this.credentials = credentials; + this.additionalParameters = Collections.unmodifiableMap(Collections.emptyMap()); setAuthenticated(true); } @Override public Object getPrincipal() { - return this.registeredClient != null ? - this.registeredClient.getClientId() : - this.clientId; + return this.clientId; } + @Nullable @Override public Object getCredentials() { - return this.clientSecret; + return this.credentials; } /** - * Returns the additional parameters + * Returns the authenticated {@link RegisteredClient registered client}, or {@code null} if not authenticated. * - * @return the additional parameters + * @return the authenticated {@link RegisteredClient}, or {@code null} if not authenticated */ - public @Nullable Map getAdditionalParameters() { - return this.additionalParameters; - } - - /** - * Returns the {@link RegisteredClient registered client}. - * - * @return the {@link RegisteredClient} - */ - public @Nullable RegisteredClient getRegisteredClient() { + @Nullable + public RegisteredClient getRegisteredClient() { return this.registeredClient; } /** - * Returns the {@link ClientAuthenticationMethod client authentication method}. + * Returns the {@link ClientAuthenticationMethod authentication method} used by the client. * - * @return the {@link ClientAuthenticationMethod} + * @return the {@link ClientAuthenticationMethod} used by the client */ - public @Nullable ClientAuthenticationMethod getClientAuthenticationMethod() { + public ClientAuthenticationMethod getClientAuthenticationMethod() { return this.clientAuthenticationMethod; } + + /** + * Returns the additional parameters. + * + * @return the additional parameters + */ + public Map getAdditionalParameters() { + return this.additionalParameters; + } + } diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretBasicAuthenticationConverter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretBasicAuthenticationConverter.java index 7e75130b..af24c7e9 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretBasicAuthenticationConverter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretBasicAuthenticationConverter.java @@ -89,7 +89,7 @@ public final class ClientSecretBasicAuthenticationConverter implements Authentic throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST), ex); } - return new OAuth2ClientAuthenticationToken(clientID, clientSecret, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, + return new OAuth2ClientAuthenticationToken(clientID, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, clientSecret, extractAdditionalParameters(request)); } diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java index 9fdc8e92..e826a74e 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java @@ -70,7 +70,7 @@ public final class ClientSecretPostAuthenticationConverter implements Authentica throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST)); } - return new OAuth2ClientAuthenticationToken(clientId, clientSecret, ClientAuthenticationMethod.CLIENT_SECRET_POST, + return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.CLIENT_SECRET_POST, clientSecret, extractAdditionalParameters(request)); } diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/PublicClientAuthenticationConverter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/PublicClientAuthenticationConverter.java index e41ca3fd..0596904e 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/PublicClientAuthenticationConverter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/PublicClientAuthenticationConverter.java @@ -20,6 +20,7 @@ import java.util.HashMap; import javax.servlet.http.HttpServletRequest; import org.springframework.security.core.Authentication; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; @@ -66,7 +67,7 @@ public final class PublicClientAuthenticationConverter implements Authentication parameters.remove(OAuth2ParameterNames.CLIENT_ID); - return new OAuth2ClientAuthenticationToken( - clientId, new HashMap<>(parameters.toSingleValueMap())); + return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.NONE, null, + new HashMap<>(parameters.toSingleValueMap())); } } diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2ClientCredentialsGrantTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2ClientCredentialsGrantTests.java index 6f743a2a..fbac2c26 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2ClientCredentialsGrantTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2ClientCredentialsGrantTests.java @@ -56,6 +56,7 @@ import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.crypto.password.NoOpPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; import org.springframework.security.oauth2.jose.TestJwks; @@ -211,7 +212,8 @@ public class OAuth2ClientCredentialsGrantTests { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); this.registeredClientRepository.save(registeredClient); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2ClientCredentialsAuthenticationToken clientCredentialsAuthentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null); when(authenticationConverter.convert(any())).thenReturn(clientCredentialsAuthentication); @@ -242,7 +244,8 @@ public class OAuth2ClientCredentialsGrantTests { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); this.registeredClientRepository.save(registeredClient); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); when(authenticationConverter.convert(any())).thenReturn(clientPrincipal); when(authenticationProvider.supports(eq(OAuth2ClientAuthenticationToken.class))).thenReturn(true); when(authenticationProvider.authenticate(any())).thenReturn(clientPrincipal); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JwtEncodingContextTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JwtEncodingContextTests.java index 1181534e..f6eefdef 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JwtEncodingContextTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/JwtEncodingContextTests.java @@ -20,6 +20,7 @@ import org.junit.Test; import org.springframework.security.authentication.TestingAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2TokenType; import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest; import org.springframework.security.oauth2.jwt.JoseHeader; @@ -83,7 +84,8 @@ public class JwtEncodingContextTests { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); TestingAuthenticationToken principal = new TestingAuthenticationToken("principal", "password"); OAuth2Authorization authorization = TestOAuth2Authorizations.authorization().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authorizationGrant = diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AccessTokenAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AccessTokenAuthenticationTokenTests.java index 21045323..d248d059 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AccessTokenAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AccessTokenAuthenticationTokenTests.java @@ -16,6 +16,8 @@ package org.springframework.security.oauth2.server.authorization.authentication; import org.junit.Test; + +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2RefreshToken; import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; @@ -36,8 +38,8 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; */ public class OAuth2AccessTokenAuthenticationTokenTests { private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - private OAuth2ClientAuthenticationToken clientPrincipal = - new OAuth2ClientAuthenticationToken(this.registeredClient); + private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "access-token", Instant.now(), Instant.now().plusSeconds(300)); private OAuth2RefreshToken refreshToken = new OAuth2RefreshToken( diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java index 490de633..34fd8247 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java @@ -142,7 +142,7 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2AuthorizationCodeAuthenticationToken authentication = new OAuth2AuthorizationCodeAuthenticationToken(AUTHORIZATION_CODE, clientPrincipal, null, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) @@ -155,7 +155,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { @Test public void authenticateWhenInvalidCodeThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationCodeAuthenticationToken authentication = new OAuth2AuthorizationCodeAuthenticationToken(AUTHORIZATION_CODE, clientPrincipal, null, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) @@ -171,8 +172,9 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); + RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient2().build()); + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationCodeAuthenticationToken authentication = new OAuth2AuthorizationCodeAuthenticationToken(AUTHORIZATION_CODE, clientPrincipal, null, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) @@ -196,7 +198,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -219,7 +222,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -244,7 +248,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -264,7 +269,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -319,7 +325,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -397,7 +404,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -435,7 +443,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(AUTHORIZATION_CODE), eq(AUTHORIZATION_CODE_TOKEN_TYPE))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = @@ -467,7 +476,8 @@ public class OAuth2AuthorizationCodeAuthenticationProviderTests { }); this.authenticationProvider.setRefreshTokenGenerator(refreshTokenGenerator); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); OAuth2AuthorizationCodeAuthenticationToken authentication = diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationTokenTests.java index 392ee3bc..9df894c4 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationTokenTests.java @@ -21,6 +21,8 @@ import java.util.Map; import org.junit.Test; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; import static org.assertj.core.api.Assertions.assertThat; @@ -34,8 +36,9 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; */ public class OAuth2AuthorizationCodeAuthenticationTokenTests { private String code = "code"; + private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient().build()); + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private String redirectUri = "redirectUri"; private Map additionalParameters = Collections.singletonMap("param1", "value1"); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java index fa6bb79f..188961f6 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java @@ -125,7 +125,7 @@ public class OAuth2ClientAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId() + "-invalid", registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId() + "-invalid", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) @@ -140,7 +140,7 @@ public class OAuth2ClientAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret() + "-invalid", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret() + "-invalid", null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) @@ -156,7 +156,7 @@ public class OAuth2ClientAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), null); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) @@ -171,14 +171,14 @@ public class OAuth2ClientAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2ClientAuthenticationToken authenticationResult = (OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication); verify(this.passwordEncoder).matches(any(), any()); assertThat(authenticationResult.isAuthenticated()).isTrue(); assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId()); - assertThat(authenticationResult.getCredentials()).isNull(); + assertThat(authenticationResult.getCredentials().toString()).isEqualTo(registeredClient.getClientSecret()); assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient); } @@ -198,7 +198,7 @@ public class OAuth2ClientAuthenticationProviderTests { parameters.put(OAuth2ParameterNames.CODE, "invalid-code"); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -224,7 +224,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -249,7 +249,7 @@ public class OAuth2ClientAuthenticationProviderTests { parameters.remove(PkceParameterNames.CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -273,7 +273,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters("invalid-code-verifier"); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -297,7 +297,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters("invalid-code-verifier"); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -321,7 +321,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); OAuth2ClientAuthenticationToken authenticationResult = (OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication); @@ -348,7 +348,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); OAuth2ClientAuthenticationToken authenticationResult = (OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication); @@ -373,7 +373,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters(S256_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); OAuth2ClientAuthenticationToken authenticationResult = (OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication); @@ -401,7 +401,7 @@ public class OAuth2ClientAuthenticationProviderTests { Map parameters = createPkceTokenParameters(PLAIN_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), parameters); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.NONE, null, parameters); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -417,7 +417,7 @@ public class OAuth2ClientAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_POST, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_POST, registeredClient.getClientSecret(), null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationTokenTests.java index 0c4c462c..22b30c2d 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationTokenTests.java @@ -16,13 +16,11 @@ package org.springframework.security.oauth2.server.authorization.authentication; import org.junit.Test; + import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; -import java.util.HashMap; -import java.util.Map; - import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; @@ -36,36 +34,29 @@ public class OAuth2ClientAuthenticationTokenTests { @Test public void constructorWhenClientIdNullThenThrowIllegalArgumentException() { - assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, "secret", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null)) + assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null)) .isInstanceOf(IllegalArgumentException.class) .hasMessage("clientId cannot be empty"); } - @Test - public void constructorWhenClientSecretNullThenThrowIllegalArgumentException() { - assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken("clientId", null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null)) - .isInstanceOf(IllegalArgumentException.class) - .hasMessage("clientSecret cannot be empty"); - } - @Test public void constructorWhenClientAuthenticationMethodNullThenThrowIllegalArgumentException() { - assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken("clientId", "clientSecret", null, null)) + assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken("clientId", null, "clientSecret", null)) .isInstanceOf(IllegalArgumentException.class) .hasMessage("clientAuthenticationMethod cannot be null"); } @Test public void constructorWhenRegisteredClientNullThenThrowIllegalArgumentException() { - assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null)) + assertThatThrownBy(() -> new OAuth2ClientAuthenticationToken(null, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "clientSecret")) .isInstanceOf(IllegalArgumentException.class) .hasMessage("registeredClient cannot be null"); } @Test public void constructorWhenClientCredentialsProvidedThenCreated() { - OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId", "secret", - ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId", + ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "secret", null); assertThat(authentication.isAuthenticated()).isFalse(); assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId"); assertThat(authentication.getCredentials()).isEqualTo("secret"); @@ -73,26 +64,15 @@ public class OAuth2ClientAuthenticationTokenTests { assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC); } - @Test - public void constructorWhenClientIdProvidedThenCreated() { - Map additionalParameters = new HashMap<>(); - additionalParameters.put("param1", "value1"); - OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken("clientId", additionalParameters); - assertThat(authentication.isAuthenticated()).isFalse(); - assertThat(authentication.getPrincipal().toString()).isEqualTo("clientId"); - assertThat(authentication.getCredentials()).isNull(); - assertThat(authentication.getAdditionalParameters()).isEqualTo(additionalParameters); - assertThat(authentication.getRegisteredClient()).isNull(); - assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.NONE); - } - @Test public void constructorWhenRegisteredClientProvidedThenCreated() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); assertThat(authentication.isAuthenticated()).isTrue(); assertThat(authentication.getPrincipal().toString()).isEqualTo(registeredClient.getClientId()); - assertThat(authentication.getCredentials()).isNull(); + assertThat(authentication.getCredentials().toString()).isEqualTo(registeredClient.getClientSecret()); assertThat(authentication.getRegisteredClient()).isEqualTo(registeredClient); + assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC); } } diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java index 6569b970..c02321c4 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java @@ -122,7 +122,7 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null); @@ -138,7 +138,8 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2() .authorizationGrantTypes(grantTypes -> grantTypes.remove(AuthorizationGrantType.CLIENT_CREDENTIALS)) .build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null); @@ -152,7 +153,8 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { @Test public void authenticateWhenInvalidScopeThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken( clientPrincipal, Collections.singleton("invalid-scope"), null); @@ -166,7 +168,8 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { @Test public void authenticateWhenScopeRequestedThenAccessTokenContainsScope() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); Set requestedScope = Collections.singleton("scope1"); OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, requestedScope, null); @@ -182,7 +185,8 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { @Test public void authenticateWhenValidAuthenticationThenReturnAccessToken() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2ClientCredentialsAuthenticationToken authentication = new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationTokenTests.java index 78d960a1..34b97c02 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationTokenTests.java @@ -22,6 +22,8 @@ import java.util.Set; import org.junit.Test; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; import static org.assertj.core.api.Assertions.assertThat; @@ -33,8 +35,9 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; * @author Alexey Nesterov */ public class OAuth2ClientCredentialsAuthenticationTokenTests { - private final OAuth2ClientAuthenticationToken clientPrincipal = - new OAuth2ClientAuthenticationToken(TestRegisteredClients.registeredClient().build()); + private final RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); + private final OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private Set scopes = Collections.singleton("scope1"); private Map additionalParameters = Collections.singletonMap("param1", "value1"); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProviderTests.java index df452b4e..08c90677 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationProviderTests.java @@ -139,7 +139,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -182,7 +183,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -250,7 +252,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -277,7 +280,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); Set authorizedScopes = authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME); Set requestedScopes = new HashSet<>(authorizedScopes); requestedScopes.remove("scope1"); @@ -310,7 +314,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { }); this.authenticationProvider.setRefreshTokenGenerator(refreshTokenGenerator); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -330,7 +335,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); Set authorizedScopes = authorization.getAttribute(OAuth2Authorization.AUTHORIZED_SCOPE_ATTRIBUTE_NAME); Set requestedScopes = new HashSet<>(authorizedScopes); requestedScopes.add("unauthorized"); @@ -347,7 +353,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { @Test public void authenticateWhenInvalidRefreshTokenThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( "invalid", clientPrincipal, null, null); @@ -377,7 +384,7 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( "refresh-token", clientPrincipal, null, null); @@ -397,8 +404,9 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); + RegisteredClient registeredClient2 = TestRegisteredClients.registeredClient2().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient2().build()); + registeredClient2, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient2.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -420,7 +428,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -443,7 +452,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); @@ -467,7 +477,8 @@ public class OAuth2RefreshTokenAuthenticationProviderTests { eq(OAuth2TokenType.REFRESH_TOKEN))) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2RefreshTokenAuthenticationToken authentication = new OAuth2RefreshTokenAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, null, null); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationTokenTests.java index 8cd5c4fd..095b2d1a 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2RefreshTokenAuthenticationTokenTests.java @@ -22,6 +22,8 @@ import java.util.Set; import org.junit.Test; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; import static org.assertj.core.api.Assertions.assertThat; @@ -34,8 +36,9 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; * @since 0.0.3 */ public class OAuth2RefreshTokenAuthenticationTokenTests { - private OAuth2ClientAuthenticationToken clientPrincipal = - new OAuth2ClientAuthenticationToken(TestRegisteredClients.registeredClient().build()); + private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); + private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private Set scopes = Collections.singleton("scope1"); private Map additionalParameters = Collections.singletonMap("param1", "value1"); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationProviderTests.java index 5a7c2bae..6bfc9716 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationProviderTests.java @@ -107,7 +107,7 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( "token", clientPrincipal, null, null); @@ -121,7 +121,8 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { @Test public void authenticateWhenInvalidTokenThenNotActive() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( "token", clientPrincipal, null, null); @@ -142,7 +143,8 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, accessToken); when(this.authorizationService.findByToken(eq(accessToken.getTokenValue()), isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( accessToken.getTokenValue(), clientPrincipal, null, null); @@ -165,7 +167,8 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).token(accessToken).build(); when(this.authorizationService.findByToken(eq(accessToken.getTokenValue()), isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( accessToken.getTokenValue(), clientPrincipal, null, null); @@ -192,7 +195,8 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { .build(); when(this.authorizationService.findByToken(eq(accessToken.getTokenValue()), isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( accessToken.getTokenValue(), clientPrincipal, null, null); @@ -220,8 +224,9 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(accessToken.getTokenValue()), isNull())) .thenReturn(authorization); when(this.registeredClientRepository.findById(eq(authorizedClient.getId()))).thenReturn(authorizedClient); + RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient2().build()); + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( accessToken.getTokenValue(), clientPrincipal, null, null); @@ -253,8 +258,9 @@ public class OAuth2TokenIntrospectionAuthenticationProviderTests { when(this.authorizationService.findByToken(eq(refreshToken.getTokenValue()), isNull())) .thenReturn(authorization); when(this.registeredClientRepository.findById(eq(authorizedClient.getId()))).thenReturn(authorizedClient); + RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient2().build()); + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenIntrospectionAuthenticationToken authentication = new OAuth2TokenIntrospectionAuthenticationToken( refreshToken.getTokenValue(), clientPrincipal, null, null); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationTokenTests.java index b0a2ebc4..af6a0615 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenIntrospectionAuthenticationTokenTests.java @@ -20,8 +20,10 @@ import java.util.Map; import org.junit.Test; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2TokenIntrospection; import org.springframework.security.oauth2.core.OAuth2TokenType; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; import static org.assertj.core.api.Assertions.assertThat; @@ -35,8 +37,9 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; */ public class OAuth2TokenIntrospectionAuthenticationTokenTests { private String token = "token"; + private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient().build()); + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private OAuth2TokenIntrospection tokenClaims = OAuth2TokenIntrospection.builder(true).build(); @Test diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationProviderTests.java index 61c48c72..fb8a94d8 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationProviderTests.java @@ -88,7 +88,7 @@ public class OAuth2TokenRevocationAuthenticationProviderTests { public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null); + registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null); OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken( "token", clientPrincipal, OAuth2TokenType.ACCESS_TOKEN.getValue()); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) @@ -101,7 +101,8 @@ public class OAuth2TokenRevocationAuthenticationProviderTests { @Test public void authenticateWhenInvalidTokenThenNotRevoked() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken( "token", clientPrincipal, OAuth2TokenType.ACCESS_TOKEN.getValue()); OAuth2TokenRevocationAuthenticationToken authenticationResult = @@ -120,7 +121,8 @@ public class OAuth2TokenRevocationAuthenticationProviderTests { isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken( "token", clientPrincipal, OAuth2TokenType.ACCESS_TOKEN.getValue()); @@ -141,7 +143,8 @@ public class OAuth2TokenRevocationAuthenticationProviderTests { isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken( authorization.getRefreshToken().getToken().getTokenValue(), clientPrincipal, OAuth2TokenType.REFRESH_TOKEN.getValue()); @@ -169,7 +172,8 @@ public class OAuth2TokenRevocationAuthenticationProviderTests { isNull())) .thenReturn(authorization); - OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2TokenRevocationAuthenticationToken authentication = new OAuth2TokenRevocationAuthenticationToken( authorization.getAccessToken().getToken().getTokenValue(), clientPrincipal, OAuth2TokenType.ACCESS_TOKEN.getValue()); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationTokenTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationTokenTests.java index 8e810147..057617b2 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationTokenTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationTokenTests.java @@ -16,8 +16,11 @@ package org.springframework.security.oauth2.server.authorization.authentication; import org.junit.Test; + +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2TokenType; +import org.springframework.security.oauth2.server.authorization.client.RegisteredClient; import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients; import java.time.Duration; @@ -34,8 +37,9 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; */ public class OAuth2TokenRevocationAuthenticationTokenTests { private String token = "token"; + private RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); private OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - TestRegisteredClients.registeredClient().build()); + this.registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, this.registeredClient.getClientSecret()); private String tokenTypeHint = OAuth2TokenType.ACCESS_TOKEN.getValue(); private OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, this.token, diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilterTests.java index 914a8af4..9b7b0794 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2ClientAuthenticationFilterTests.java @@ -167,7 +167,7 @@ public class OAuth2ClientAuthenticationFilterTests { @Test public void doFilterWhenRequestMatchesAndBadCredentialsThenInvalidClientError() throws Exception { when(this.authenticationConverter.convert(any(HttpServletRequest.class))).thenReturn( - new OAuth2ClientAuthenticationToken("clientId", "invalid-secret", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null)); + new OAuth2ClientAuthenticationToken("clientId", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, "invalid-secret", null)); when(this.authenticationManager.authenticate(any(Authentication.class))).thenThrow( new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT))); @@ -192,9 +192,9 @@ public class OAuth2ClientAuthenticationFilterTests { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); when(this.authenticationConverter.convert(any(HttpServletRequest.class))).thenReturn( - new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null)); + new OAuth2ClientAuthenticationToken(registeredClient.getClientId(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret(), null)); when(this.authenticationManager.authenticate(any(Authentication.class))).thenReturn( - new OAuth2ClientAuthenticationToken(registeredClient)); + new OAuth2ClientAuthenticationToken(registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret())); MockHttpServletRequest request = new MockHttpServletRequest("POST", this.filterProcessesUrl); request.setServletPath(this.filterProcessesUrl); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilterTests.java index 9ee4db79..329cd905 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilterTests.java @@ -42,6 +42,7 @@ import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; @@ -224,7 +225,8 @@ public class OAuth2TokenEndpointFilterTests { @Test public void doFilterWhenAuthorizationCodeTokenRequestThenAccessTokenResponse() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), @@ -296,7 +298,8 @@ public class OAuth2TokenEndpointFilterTests { @Test public void doFilterWhenClientCredentialsTokenRequestThenAccessTokenResponse() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), @@ -383,7 +386,8 @@ public class OAuth2TokenEndpointFilterTests { @Test public void doFilterWhenRefreshTokenRequestThenAccessTokenResponse() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), @@ -443,7 +447,8 @@ public class OAuth2TokenEndpointFilterTests { @Test public void doFilterWhenCustomAuthenticationConverterThenUsed() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AuthorizationCodeAuthenticationToken authorizationCodeAuthentication = new OAuth2AuthorizationCodeAuthenticationToken("code", clientPrincipal, null, null); @@ -480,7 +485,8 @@ public class OAuth2TokenEndpointFilterTests { this.filter.setAuthenticationSuccessHandler(authenticationSuccessHandler); RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java index 0b66bde1..8b1f468c 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilterTests.java @@ -38,6 +38,7 @@ import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; @@ -159,7 +160,8 @@ public class OAuth2TokenIntrospectionEndpointFilterTests { @Test public void doFilterWhenTokenIntrospectionRequestValidThenSuccessResponse() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)), diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java index 00634e5f..ac2bf732 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilterTests.java @@ -38,6 +38,7 @@ import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AccessToken; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; @@ -148,7 +149,8 @@ public class OAuth2TokenRevocationEndpointFilterTests { @Test public void doFilterWhenTokenRevocationRequestValidThenSuccessResponse() throws Exception { RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build(); - Authentication clientPrincipal = new OAuth2ClientAuthenticationToken(registeredClient); + Authentication clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); OAuth2AccessToken accessToken = new OAuth2AccessToken( OAuth2AccessToken.TokenType.BEARER, "token", Instant.now(), Instant.now().plus(Duration.ofHours(1)),