Implement OAuth 2.0 Server Metadata (RFC 8414)

See See https://tools.ietf.org/html/rfc8414 Closes gh-54
2020-11-10 11:59:00 +01:00
parent a30a1692b2
commit 0a4775423b
24 changed files with 2123 additions and 417 deletions
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurationTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurationTests.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;
+
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.source.JWKSource;
+import com.nimbusds.jose.proc.SecurityContext;
+import org.junit.BeforeClass;
+import org.junit.Rule;
+import org.junit.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Import;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
+import org.springframework.security.config.test.SpringTestRule;
+import org.springframework.security.oauth2.jose.TestJwks;
+import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
+import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;
+import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationServerConfigurationEndpointFilter;
+import org.springframework.test.web.servlet.MockMvc;
+
+import static org.mockito.Mockito.mock;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * Integration tests for OAuth 2.0 Authorization Server Configuration.
+ *
+ * @author Daniel Garnier-Moiroux
+ */
+public class OAuth2AuthorizationServerConfigurationTests {
+	private static final String issuerUrl = "https://example.com/issuer1";
+	private static JWKSource<SecurityContext> jwkSource;
+
+	@Rule
+	public final SpringTestRule spring = new SpringTestRule();
+
+	@Autowired
+	private MockMvc mvc;
+
+	@BeforeClass
+	public static void setupClass() {
+		JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
+		jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
+	}
+
+	@Test
+	public void requestWhenServerConfigurationRequestAndIssuerSetThenReturnServerConfigurationResponse() throws Exception {
+		this.spring.register(AuthorizationServerConfiguration.class).autowire();
+
+		this.mvc.perform(get(OAuth2AuthorizationServerConfigurationEndpointFilter.DEFAULT_OAUTH2_AUTHORIZATION_SERVER_CONFIGURATION_ENDPOINT_URI))
+				.andExpect(status().is2xxSuccessful())
+				.andExpect(jsonPath("issuer").value(issuerUrl))
+				.andReturn();
+	}
+
+	@EnableWebSecurity
+	@Import(OAuth2AuthorizationServerConfiguration.class)
+	static class AuthorizationServerConfiguration {
+
+		@Bean
+		RegisteredClientRepository registeredClientRepository() {
+			return mock(RegisteredClientRepository.class);
+		}
+
+		@Bean
+		JWKSource<SecurityContext> jwkSource() {
+			return jwkSource;
+		}
+
+		@Bean
+		ProviderSettings providerSettings() {
+			return new ProviderSettings().issuer(issuerUrl);
+		}
+	}
+}
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationServerConfigurationTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/endpoint/OAuth2AuthorizationServerConfigurationTests.java
@@ -0,0 +1,451 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.core.endpoint;
+
+import org.junit.Test;
+import org.springframework.security.oauth2.core.OAuth2AuthorizationServerMetadataClaimNames;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationServerConfiguration.Builder;
+
+import java.net.URL;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashSet;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests for {@link OAuth2AuthorizationServerConfiguration}.
+ *
+ * @author Daniel Garnier-Moiroux
+ */
+public class OAuth2AuthorizationServerConfigurationTests {
+	private final Builder minimalConfigurationBuilder =
+			OAuth2AuthorizationServerConfiguration.builder()
+					.issuer("https://example.com/issuer1")
+					.authorizationEndpoint("https://example.com/issuer1/oauth2/authorize")
+					.tokenEndpoint("https://example.com/issuer1/oauth2/token")
+					.jwkSetUri("https://example.com/issuer1/oauth2/jwks")
+					.scope("openid")
+					.responseType("code");
+
+	@Test
+	public void buildWhenAllRequiredClaimsAndAdditionalClaimsThenCreated() {
+		OAuth2AuthorizationServerConfiguration authorizationServerConfiguration = OAuth2AuthorizationServerConfiguration.builder()
+				.issuer("https://example.com/issuer1")
+				.authorizationEndpoint("https://example.com/issuer1/oauth2/authorize")
+				.tokenEndpoint("https://example.com/issuer1/oauth2/token")
+				.tokenRevocationEndpoint("https://example.com/issuer1/oauth2/revoke")
+				.jwkSetUri("https://example.com/issuer1/oauth2/jwks")
+				.scope("openid")
+				.responseType("code")
+				.grantType("authorization_code")
+				.grantType("client_credentials")
+				.tokenEndpointAuthenticationMethod("client_secret_basic")
+				.tokenRevocationEndpointAuthenticationMethod("client_secret_basic")
+				.codeChallengeMethod("plain")
+				.codeChallengeMethod("S256")
+				.claim("a-claim", "a-value")
+				.build();
+
+		assertThat(authorizationServerConfiguration.getIssuer()).isEqualTo(url("https://example.com/issuer1"));
+		assertThat(authorizationServerConfiguration.getAuthorizationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(authorizationServerConfiguration.getTokenEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/token"));
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/revoke"));
+		assertThat(authorizationServerConfiguration.getJwkSetUri()).isEqualTo(url("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(authorizationServerConfiguration.getScopes()).containsExactly("openid");
+		assertThat(authorizationServerConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(authorizationServerConfiguration.getGrantTypes()).containsExactlyInAnyOrder("authorization_code", "client_credentials");
+		assertThat(authorizationServerConfiguration.getTokenEndpointAuthenticationMethods()).containsExactly("client_secret_basic");
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpointAuthenticationMethods()).containsExactly("client_secret_basic");
+		assertThat(authorizationServerConfiguration.getCodeChallengeMethods()).containsExactlyInAnyOrder("plain", "S256");
+		assertThat(authorizationServerConfiguration.getClaimAsString("a-claim")).isEqualTo("a-value");
+	}
+
+	@Test
+	public void buildWhenOnlyRequiredClaimsThenCreated() {
+		OAuth2AuthorizationServerConfiguration authorizationServerConfiguration = OAuth2AuthorizationServerConfiguration.builder()
+				.issuer("https://example.com/issuer1")
+				.authorizationEndpoint("https://example.com/issuer1/oauth2/authorize")
+				.tokenEndpoint("https://example.com/issuer1/oauth2/token")
+				.jwkSetUri("https://example.com/issuer1/oauth2/jwks")
+				.scope("openid")
+				.responseType("code")
+				.build();
+
+		assertThat(authorizationServerConfiguration.getIssuer()).isEqualTo(url("https://example.com/issuer1"));
+		assertThat(authorizationServerConfiguration.getAuthorizationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(authorizationServerConfiguration.getTokenEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/token"));
+		assertThat(authorizationServerConfiguration.getJwkSetUri()).isEqualTo(url("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(authorizationServerConfiguration.getScopes()).containsExactly("openid");
+		assertThat(authorizationServerConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(authorizationServerConfiguration.getGrantTypes()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpoint()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getCodeChallengeMethods()).isNull();
+	}
+
+	@Test
+	public void buildFromClaimsThenCreated() {
+		HashMap<String, Object> claims = new HashMap<>();
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.ISSUER, "https://example.com/issuer1");
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT, "https://example.com/issuer1/oauth2/authorize");
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT, "https://example.com/issuer1/oauth2/token");
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI, "https://example.com/issuer1/oauth2/jwks");
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.SCOPES_SUPPORTED, Collections.singletonList("openid"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, Collections.singletonList("code"));
+		claims.put("some-claim", "some-value");
+
+		OAuth2AuthorizationServerConfiguration authorizationServerConfiguration = OAuth2AuthorizationServerConfiguration.withClaims(claims).build();
+
+		assertThat(authorizationServerConfiguration.getIssuer()).isEqualTo(url("https://example.com/issuer1"));
+		assertThat(authorizationServerConfiguration.getAuthorizationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(authorizationServerConfiguration.getTokenEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/token"));
+		assertThat(authorizationServerConfiguration.getJwkSetUri()).isEqualTo(url("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(authorizationServerConfiguration.getScopes()).containsExactly("openid");
+		assertThat(authorizationServerConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(authorizationServerConfiguration.getGrantTypes()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpoint()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getCodeChallengeMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getClaimAsString("some-claim")).isEqualTo("some-value");
+	}
+
+	@Test
+	public void buildFromClaimsWhenUsingUrlsThenCreated() {
+		HashMap<String, Object> claims = new HashMap<>();
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.ISSUER, url("https://example.com/issuer1"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT, url("https://example.com/issuer1/oauth2/authorize"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT, url("https://example.com/issuer1/oauth2/token"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.REVOCATION_ENDPOINT, url("https://example.com/issuer1/oauth2/revoke"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI, url("https://example.com/issuer1/oauth2/jwks"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.SCOPES_SUPPORTED, Collections.singletonList("openid"));
+		claims.put(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, Collections.singletonList("code"));
+		claims.put("some-claim", "some-value");
+
+		OAuth2AuthorizationServerConfiguration authorizationServerConfiguration = OAuth2AuthorizationServerConfiguration.withClaims(claims).build();
+
+		assertThat(authorizationServerConfiguration.getIssuer()).isEqualTo(url("https://example.com/issuer1"));
+		assertThat(authorizationServerConfiguration.getAuthorizationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(authorizationServerConfiguration.getTokenEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/token"));
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpoint()).isEqualTo(url("https://example.com/issuer1/oauth2/revoke"));
+		assertThat(authorizationServerConfiguration.getJwkSetUri()).isEqualTo(url("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(authorizationServerConfiguration.getScopes()).containsExactly("openid");
+		assertThat(authorizationServerConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(authorizationServerConfiguration.getGrantTypes()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getTokenRevocationEndpointAuthenticationMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getCodeChallengeMethods()).isNull();
+		assertThat(authorizationServerConfiguration.getClaimAsString("some-claim")).isEqualTo("some-value");
+	}
+
+	@Test
+	public void withClaimsWhenNullThenThrowsIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OAuth2AuthorizationServerConfiguration.withClaims(null))
+				.withMessage("claims cannot be empty");
+	}
+
+	@Test
+	public void withClaimsWhenMissingRequiredClaimsThenThrowsIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OAuth2AuthorizationServerConfiguration.withClaims(Collections.emptyMap()))
+				.withMessage("claims cannot be empty");
+	}
+
+	@Test
+	public void buildWhenCalledTwiceThenGeneratesTwoConfigurations() {
+		OAuth2AuthorizationServerConfiguration first = this.minimalConfigurationBuilder
+				.grantType("client_credentials")
+				.build();
+
+		OAuth2AuthorizationServerConfiguration second = this.minimalConfigurationBuilder
+				.claims((claims) ->
+						{
+							LinkedHashSet<String> newGrantTypes = new LinkedHashSet<>();
+							newGrantTypes.add("authorization_code");
+							newGrantTypes.add("custom_grant");
+							claims.put(OAuth2AuthorizationServerMetadataClaimNames.GRANT_TYPES_SUPPORTED, newGrantTypes);
+						}
+				)
+				.build();
+
+		assertThat(first.getGrantTypes()).containsExactly("client_credentials");
+		assertThat(second.getGrantTypes()).containsExactlyInAnyOrder("authorization_code", "custom_grant");
+	}
+
+	@Test
+	public void buildWhenEmptyClaimsThenOmitted() {
+		OAuth2AuthorizationServerConfiguration authorizationServerConfiguration = this.minimalConfigurationBuilder
+				.claim("some-claim", Collections.emptyList())
+				.claims(claims -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.GRANT_TYPES_SUPPORTED, Collections.emptyList()))
+				.build();
+
+		assertThat(authorizationServerConfiguration.getClaimAsStringList("some-claim")).isNull();
+		assertThat(authorizationServerConfiguration.getClaimAsStringList(OAuth2AuthorizationServerMetadataClaimNames.GRANT_TYPES_SUPPORTED)).isNull();
+	}
+
+	@Test
+	public void buildWhenMissingIssuerThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.ISSUER));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("issuer cannot be null");
+	}
+
+	@Test
+	public void buildWhenIssuerIsNotAnUrlThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.ISSUER, "not an url"));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("issuer must be a valid URL");
+	}
+
+	@Test
+	public void buildWhenMissingAuthorizationEndpointThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("authorizationEndpoint cannot be null");
+	}
+
+	@Test
+	public void buildWhenAuthorizationEndpointIsNotAnUrlThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.AUTHORIZATION_ENDPOINT, "not an url"));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("authorizationEndpoint must be a valid URL");
+	}
+
+	@Test
+	public void buildWhenMissingTokenEndpointThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("tokenEndpoint cannot be null");
+	}
+
+	@Test
+	public void buildWhenTokenEndpointIsNotAnUrlThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.TOKEN_ENDPOINT, "not an url"));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("tokenEndpoint must be a valid URL");
+	}
+
+	@Test
+	public void buildWhenMissingJwksUriThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("jwksUri cannot be null");
+	}
+
+	@Test
+	public void buildWhenJwksUriIsNotAnUrlThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI, "not an url"));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("jwksUri must be a valid URL");
+	}
+
+	@Test
+	public void buildWhenMissingResponseTypesThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("responseTypes cannot be null");
+	}
+
+	@Test
+	public void buildWhenResponseTypesNotListThenThrowIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, "not-a-list"));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("responseTypes must be of type List");
+	}
+
+	@Test
+	public void buildWhenResponseTypesEmptyListThenThrowIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, Collections.emptyList()));
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("responseTypes cannot be empty");
+	}
+
+	@Test
+	public void buildWhenInvalidTokenRevocationEndpointThenThrowsIllegalArgumentException() {
+		Builder builder = this.minimalConfigurationBuilder
+				.tokenRevocationEndpoint("not a valid URL");
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("tokenRevocationEndpoint must be a valid URL");
+	}
+
+	@Test
+	public void responseTypesWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.responseType("should-be-removed")
+				.responseTypes(responseTypes -> {
+					responseTypes.clear();
+					responseTypes.add("some-response-type");
+				})
+				.build();
+
+		assertThat(configuration.getResponseTypes()).containsExactly("some-response-type");
+	}
+
+	@Test
+	public void responseTypesWhenNotPresentAndAddingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.claims(claims -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.RESPONSE_TYPES_SUPPORTED))
+				.responseTypes(responseTypes -> responseTypes.add("some-response-type"))
+				.build();
+
+		assertThat(configuration.getResponseTypes()).containsExactly("some-response-type");
+	}
+
+	@Test
+	public void scopesWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.scope("should-be-removed")
+				.scopes(scopes -> {
+					scopes.clear();
+					scopes.add("some-scope");
+				})
+				.build();
+
+		assertThat(configuration.getScopes()).containsExactly("some-scope");
+	}
+
+	@Test
+	public void grantTypesWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.grantType("should-be-removed")
+				.grantTypes(grantTypes -> {
+					grantTypes.clear();
+					grantTypes.add("some-grant-type");
+				})
+				.build();
+
+		assertThat(configuration.getGrantTypes()).containsExactly("some-grant-type");
+	}
+
+	@Test
+	public void tokenEndpointAuthenticationMethodsWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.tokenEndpointAuthenticationMethod("should-be-removed")
+				.tokenEndpointAuthenticationMethods(authMethods -> {
+					authMethods.clear();
+					authMethods.add("some-authentication-method");
+				})
+				.build();
+
+		assertThat(configuration.getTokenEndpointAuthenticationMethods()).containsExactly("some-authentication-method");
+	}
+
+	@Test
+	public void tokenRevocationEndpointAuthenticationMethodsWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.tokenRevocationEndpointAuthenticationMethod("should-be-removed")
+				.tokenRevocationEndpointAuthenticationMethods(authMethods -> {
+					authMethods.clear();
+					authMethods.add("some-authentication-method");
+				})
+				.build();
+
+		assertThat(configuration.getTokenRevocationEndpointAuthenticationMethods()).containsExactly("some-authentication-method");
+	}
+
+	@Test
+	public void codeChallengeMethodsMethodsWhenAddingOrRemovingThenCorrectValues() {
+		OAuth2AuthorizationServerConfiguration configuration = this.minimalConfigurationBuilder
+				.codeChallengeMethod("should-be-removed")
+				.codeChallengeMethods(codeChallengeMethods -> {
+					codeChallengeMethods.clear();
+					codeChallengeMethods.add("some-authentication-method");
+				})
+				.build();
+
+		assertThat(configuration.getCodeChallengeMethods()).containsExactly("some-authentication-method");
+	}
+
+	@Test
+	public void claimWhenNameIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OAuth2AuthorizationServerConfiguration.builder().claim(null, "value"))
+				.withMessage("name cannot be empty");
+	}
+
+	@Test
+	public void claimWhenValueIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OAuth2AuthorizationServerConfiguration.builder().claim("claim-name", null))
+				.withMessage("value cannot be null");
+	}
+
+	@Test
+	public void claimsWhenRemovingClaimThenNotPresent() {
+		OAuth2AuthorizationServerConfiguration configuration =
+				this.minimalConfigurationBuilder
+						.grantType("some-grant-type")
+						.claims((claims) -> claims.remove(OAuth2AuthorizationServerMetadataClaimNames.GRANT_TYPES_SUPPORTED))
+						.build();
+		assertThat(configuration.getGrantTypes()).isNull();
+	}
+
+	@Test
+	public void claimsWhenAddingClaimThenPresent() {
+		OAuth2AuthorizationServerConfiguration configuration =
+				this.minimalConfigurationBuilder
+						.claims((claims) -> claims.put(OAuth2AuthorizationServerMetadataClaimNames.GRANT_TYPES_SUPPORTED, "authorization_code"))
+						.build();
+		assertThat(configuration.getGrantTypes()).containsExactly("authorization_code");
+	}
+
+	private static URL url(String urlString) {
+		try {
+			return new URL(urlString);
+		} catch (Exception ex) {
+			throw new IllegalArgumentException("urlString must be a valid URL and valid URI");
+		}
+	}
+}
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/endpoint/PkceCodeChallengeMethod2Test.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/endpoint/PkceCodeChallengeMethod2Test.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.core.endpoint;
+
+import org.junit.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * TODO
+ * This class is temporary and will be removed after upgrading to Spring Security 5.5.0 GA.
+ *
+ * Tests for {@link PkceCodeChallengeMethod2}.
+ *
+ * @author Daniel Garnier-Moiroux
+ */
+public class PkceCodeChallengeMethod2Test {
+
+	@Test
+	public void getValueWhenCodeChallengeMethodPlainThenReturnPlain() {
+		assertThat(PkceCodeChallengeMethod2.PLAIN.getValue()).isEqualTo("plain");
+	}
+
+	@Test
+	public void getValueWhenCodeChallengeMethodS256ThenReturnS256() {
+		assertThat(PkceCodeChallengeMethod2.S256.getValue()).isEqualTo("S256");
+	}
+}
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/http/converter/OAuth2AuthorizationServerConfigurationHttpMessageConverterTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/http/converter/OAuth2AuthorizationServerConfigurationHttpMessageConverterTests.java
@@ -0,0 +1,218 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.core.http.converter;
+
+
+import org.junit.Test;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.converter.HttpMessageNotReadableException;
+import org.springframework.http.converter.HttpMessageNotWritableException;
+import org.springframework.mock.http.MockHttpOutputMessage;
+import org.springframework.mock.http.client.MockClientHttpResponse;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationServerConfiguration;
+
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests for {@link OAuth2AuthorizationServerConfigurationHttpMessageConverter}
+ *
+ * @author Daniel Garnier-Moiroux
+ */
+public class OAuth2AuthorizationServerConfigurationHttpMessageConverterTests {
+	private final OAuth2AuthorizationServerConfigurationHttpMessageConverter messageConverter = new OAuth2AuthorizationServerConfigurationHttpMessageConverter();
+
+	@Test
+	public void supportsWhenOAuth2AuthorizationServerConfigurationThenTrue() {
+		assertThat(this.messageConverter.supports(OAuth2AuthorizationServerConfiguration.class)).isTrue();
+	}
+
+	@Test
+	public void setAuthorizationServerConfigurationParametersConverterWhenConverterIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.messageConverter.setAuthorizationServerConfigurationParametersConverter(null));
+	}
+
+	@Test
+	public void setAuthorizationServerConfigurationConverterWhenConverterIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.messageConverter.setAuthorizationServerConfigurationConverter(null));
+	}
+
+	@Test
+	public void readInternalWhenRequiredParametersThenSuccess() throws Exception {
+		// @formatter:off
+		String serverConfigurationResponse = "{\n"
+				+ "		\"issuer\": \"https://example.com/issuer1\",\n"
+				+ "		\"authorization_endpoint\": \"https://example.com/issuer1/oauth2/authorize\",\n"
+				+ "		\"token_endpoint\": \"https://example.com/issuer1/oauth2/token\",\n"
+				+ "		\"jwks_uri\": \"https://example.com/issuer1/oauth2/jwks\",\n"
+				+ "		\"response_types_supported\": [\"code\"]\n"
+				+ "}\n";
+		// @formatter:on
+		MockClientHttpResponse response = new MockClientHttpResponse(serverConfigurationResponse.getBytes(), HttpStatus.OK);
+		OAuth2AuthorizationServerConfiguration serverConfiguration = this.messageConverter
+				.readInternal(OAuth2AuthorizationServerConfiguration.class, response);
+
+		assertThat(serverConfiguration.getIssuer()).isEqualTo(new URL("https://example.com/issuer1"));
+		assertThat(serverConfiguration.getAuthorizationEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(serverConfiguration.getTokenEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/token"));
+		assertThat(serverConfiguration.getJwkSetUri()).isEqualTo(new URL("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(serverConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(serverConfiguration.getScopes()).isNull();
+		assertThat(serverConfiguration.getGrantTypes()).isNull();
+		assertThat(serverConfiguration.getTokenEndpointAuthenticationMethods()).isNull();
+		assertThat(serverConfiguration.getCodeChallengeMethods()).isNull();
+		assertThat(serverConfiguration.getTokenRevocationEndpoint()).isNull();
+		assertThat(serverConfiguration.getTokenRevocationEndpointAuthenticationMethods()).isNull();
+	}
+
+	@Test
+	public void readInternalWhenValidParametersThenSuccess() throws Exception {
+		// @formatter:off
+		String serverConfigurationResponse = "{\n"
+				+ "		\"issuer\": \"https://example.com/issuer1\",\n"
+				+ "		\"authorization_endpoint\": \"https://example.com/issuer1/oauth2/authorize\",\n"
+				+ "		\"token_endpoint\": \"https://example.com/issuer1/oauth2/token\",\n"
+				+ "		\"revocation_endpoint\": \"https://example.com/issuer1/oauth2/revoke\",\n"
+				+ "		\"jwks_uri\": \"https://example.com/issuer1/oauth2/jwks\",\n"
+				+ "		\"response_types_supported\": [\"code\"],\n"
+				+ "		\"grant_types_supported\": [\"authorization_code\", \"client_credentials\"],\n"
+				+ "		\"scopes_supported\": [\"openid\"],\n"
+				+ "		\"token_endpoint_auth_methods_supported\": [\"client_secret_basic\"],\n"
+				+ "		\"revocation_endpoint_auth_methods_supported\": [\"client_secret_basic\"],\n"
+				+ "		\"code_challenge_methods_supported\": [\"plain\",\"S256\"],\n"
+				+ "		\"custom_claim\": \"value\",\n"
+				+ "		\"custom_collection_claim\": [\"value1\", \"value2\"]\n"
+				+ "}\n";
+		// @formatter:on
+		MockClientHttpResponse response = new MockClientHttpResponse(serverConfigurationResponse.getBytes(), HttpStatus.OK);
+		OAuth2AuthorizationServerConfiguration serverConfiguration = this.messageConverter
+				.readInternal(OAuth2AuthorizationServerConfiguration.class, response);
+
+		assertThat(serverConfiguration.getClaims()).hasSize(13);
+		assertThat(serverConfiguration.getIssuer()).isEqualTo(new URL("https://example.com/issuer1"));
+		assertThat(serverConfiguration.getAuthorizationEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/authorize"));
+		assertThat(serverConfiguration.getTokenEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/token"));
+		assertThat(serverConfiguration.getTokenRevocationEndpoint()).isEqualTo(new URL("https://example.com/issuer1/oauth2/revoke"));
+		assertThat(serverConfiguration.getJwkSetUri()).isEqualTo(new URL("https://example.com/issuer1/oauth2/jwks"));
+		assertThat(serverConfiguration.getResponseTypes()).containsExactly("code");
+		assertThat(serverConfiguration.getGrantTypes()).containsExactlyInAnyOrder("authorization_code", "client_credentials");
+		assertThat(serverConfiguration.getScopes()).containsExactly("openid");
+		assertThat(serverConfiguration.getTokenEndpointAuthenticationMethods()).containsExactly("client_secret_basic");
+		assertThat(serverConfiguration.getTokenRevocationEndpointAuthenticationMethods()).containsExactly("client_secret_basic");
+		assertThat(serverConfiguration.getCodeChallengeMethods()).containsExactlyInAnyOrder("plain", "S256");
+		assertThat(serverConfiguration.getClaimAsString("custom_claim")).isEqualTo("value");
+		assertThat(serverConfiguration.getClaimAsStringList("custom_collection_claim")).containsExactlyInAnyOrder("value1", "value2");
+	}
+
+	@Test
+	public void readInternalWhenFailingConverterThenThrowException() {
+		String errorMessage = "this is not a valid converter";
+		this.messageConverter.setAuthorizationServerConfigurationConverter(source -> {
+			throw new RuntimeException(errorMessage);
+		});
+		MockClientHttpResponse response = new MockClientHttpResponse("{}".getBytes(), HttpStatus.OK);
+
+		assertThatExceptionOfType(HttpMessageNotReadableException.class)
+				.isThrownBy(() -> this.messageConverter.readInternal(OAuth2AuthorizationServerConfiguration.class, response))
+				.withMessageContaining("An error occurred reading the OAuth 2.0 Authorization Server Configuration")
+				.withMessageContaining(errorMessage);
+	}
+
+	@Test
+	public void readInternalWhenInvalidOAuth2AuthorizationServerConfigurationThenThrowException() {
+		String providerConfigurationResponse = "{ \"issuer\": null }";
+		MockClientHttpResponse response = new MockClientHttpResponse(providerConfigurationResponse.getBytes(), HttpStatus.OK);
+
+		assertThatExceptionOfType(HttpMessageNotReadableException.class)
+				.isThrownBy(() -> this.messageConverter.readInternal(OAuth2AuthorizationServerConfiguration.class, response))
+				.withMessageContaining("An error occurred reading the OAuth 2.0 Authorization Server Configuration")
+				.withMessageContaining("issuer cannot be null");
+	}
+
+	@Test
+	public void writeInternalWhenOAuth2AuthorizationServerConfigurationThenSuccess() {
+		OAuth2AuthorizationServerConfiguration serverConfiguration =
+				OAuth2AuthorizationServerConfiguration
+						.builder()
+						.issuer("https://example.com/issuer1")
+						.authorizationEndpoint("https://example.com/issuer1/oauth2/authorize")
+						.tokenEndpoint("https://example.com/issuer1/oauth2/token")
+						.tokenRevocationEndpoint("https://example.com/issuer1/oauth2/revoke")
+						.jwkSetUri("https://example.com/issuer1/oauth2/jwks")
+						.scope("openid")
+						.responseType("code")
+						.grantType("authorization_code")
+						.grantType("client_credentials")
+						.tokenEndpointAuthenticationMethod("client_secret_basic")
+						.tokenRevocationEndpointAuthenticationMethod("client_secret_basic")
+						.codeChallengeMethod("plain")
+						.codeChallengeMethod("S256")
+						.claim("custom_claim", "value")
+						.claim("custom_collection_claim", Arrays.asList("value1", "value2"))
+						.build();
+		MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();
+
+		this.messageConverter.writeInternal(serverConfiguration, outputMessage);
+
+		String serverConfigurationResponse = outputMessage.getBodyAsString();
+		assertThat(serverConfigurationResponse).contains("\"issuer\":\"https://example.com/issuer1\"");
+		assertThat(serverConfigurationResponse).contains("\"authorization_endpoint\":\"https://example.com/issuer1/oauth2/authorize\"");
+		assertThat(serverConfigurationResponse).contains("\"token_endpoint\":\"https://example.com/issuer1/oauth2/token\"");
+		assertThat(serverConfigurationResponse).contains("\"revocation_endpoint\":\"https://example.com/issuer1/oauth2/revoke\"");
+		assertThat(serverConfigurationResponse).contains("\"jwks_uri\":\"https://example.com/issuer1/oauth2/jwks\"");
+		assertThat(serverConfigurationResponse).contains("\"scopes_supported\":[\"openid\"]");
+		assertThat(serverConfigurationResponse).contains("\"response_types_supported\":[\"code\"]");
+		assertThat(serverConfigurationResponse).contains("\"grant_types_supported\":[\"authorization_code\",\"client_credentials\"]");
+		assertThat(serverConfigurationResponse).contains("\"token_endpoint_auth_methods_supported\":[\"client_secret_basic\"]");
+		assertThat(serverConfigurationResponse).contains("\"revocation_endpoint_auth_methods_supported\":[\"client_secret_basic\"]");
+		assertThat(serverConfigurationResponse).contains("\"code_challenge_methods_supported\":[\"plain\",\"S256\"]");
+		assertThat(serverConfigurationResponse).contains("\"custom_claim\":\"value\"");
+		assertThat(serverConfigurationResponse).contains("\"custom_collection_claim\":[\"value1\",\"value2\"]");
+
+	}
+
+	@Test
+	public void writeInternalWhenWriteFailsThenThrowsException() {
+		String errorMessage = "this is not a valid converter";
+		Converter<OAuth2AuthorizationServerConfiguration, Map<String, Object>> failingConverter =
+				source -> {
+					throw new RuntimeException(errorMessage);
+				};
+		this.messageConverter.setAuthorizationServerConfigurationParametersConverter(failingConverter);
+
+		MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();
+		OAuth2AuthorizationServerConfiguration serverConfiguration =
+				OAuth2AuthorizationServerConfiguration
+						.builder()
+						.issuer("https://example.com/issuer1")
+						.authorizationEndpoint("https://example.com/issuer1/oauth2/authorize")
+						.tokenEndpoint("https://example.com/issuer1/oauth2/token")
+						.jwkSetUri("https://example.com/issuer1/oauth2/jwks")
+						.responseType("code")
+						.build();
+
+		assertThatExceptionOfType(HttpMessageNotWritableException.class)
+				.isThrownBy(() -> this.messageConverter.writeInternal(serverConfiguration, outputMessage))
+				.withMessageContaining("An error occurred writing the OAuth 2.0 Authorization Server Configuration")
+				.withMessageContaining(errorMessage);
+	}
+}
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/oidc/OidcProviderConfigurationTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/oidc/OidcProviderConfigurationTests.java
@@ -25,7 +25,7 @@ import java.util.Map;
 import java.util.Set;

 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;

 /**
 * Tests for {@link OidcProviderConfiguration}.
@@ -157,15 +157,16 @@ public class OidcProviderConfigurationTests {

 	@Test
 	public void withClaimsWhenNullThenThrowIllegalArgumentException() {
-		assertThatThrownBy(() -> OidcProviderConfiguration.withClaims(null))
-				.isInstanceOf(IllegalArgumentException.class);
+		assertThatIllegalArgumentException().isThrownBy(() -> OidcProviderConfiguration.withClaims(null))
+				.isInstanceOf(IllegalArgumentException.class)
+				.withMessage("claims cannot be empty");
 	}

 	@Test
 	public void withClaimsWhenMissingRequiredClaimsThenThrowIllegalArgumentException() {
-		assertThatThrownBy(() -> OidcProviderConfiguration.withClaims(Collections.emptyMap()))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("claims cannot be empty");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OidcProviderConfiguration.withClaims(Collections.emptyMap()))
+				.withMessage("claims cannot be empty");
 	}

 	@Test
@@ -189,14 +190,25 @@ public class OidcProviderConfigurationTests {
 		assertThat(second.getGrantTypes()).containsExactlyInAnyOrder("authorization_code", "custom_grant");
 	}

+	@Test
+	public void buildWhenEmptyClaimsThenOmitted() {
+		OidcProviderConfiguration providerConfiguration = this.minimalConfigurationBuilder
+				.claim("some-claim", Collections.emptyList())
+				.claims(claims -> claims.put(OidcProviderMetadataClaimNames.GRANT_TYPES_SUPPORTED, Collections.emptyList()))
+				.build();
+
+		assertThat(providerConfiguration.getClaimAsStringList("some-claim")).isNull();
+		assertThat(providerConfiguration.getClaimAsStringList(OidcProviderMetadataClaimNames.GRANT_TYPES_SUPPORTED)).isNull();
+	}
+
 	@Test
 	public void buildWhenMissingIssuerThenThrowIllegalArgumentException() {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.ISSUER));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("issuer cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("issuer cannot be null");
 	}

 	@Test
@@ -204,9 +216,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.put(OidcProviderMetadataClaimNames.ISSUER, "not an url"));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("issuer must be a valid URL");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("issuer must be a valid URL");
 	}

 	@Test
@@ -214,9 +226,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.AUTHORIZATION_ENDPOINT));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("authorizationEndpoint cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("authorizationEndpoint cannot be null");
 	}

 	@Test
@@ -224,9 +236,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.put(OidcProviderMetadataClaimNames.AUTHORIZATION_ENDPOINT, "not an url"));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageStartingWith("authorizationEndpoint must be a valid URL");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("authorizationEndpoint must be a valid URL");
 	}

 	@Test
@@ -234,9 +246,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.TOKEN_ENDPOINT));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("tokenEndpoint cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("tokenEndpoint cannot be null");
 	}

 	@Test
@@ -244,9 +256,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.put(OidcProviderMetadataClaimNames.TOKEN_ENDPOINT, "not an url"));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageStartingWith("tokenEndpoint must be a valid URL");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("tokenEndpoint must be a valid URL");
 	}

 	@Test
@@ -254,9 +266,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.JWKS_URI));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("jwksUri cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("jwksUri cannot be null");
 	}

 	@Test
@@ -264,9 +276,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.put(OidcProviderMetadataClaimNames.JWKS_URI, "not an url"));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageStartingWith("jwksUri must be a valid URL");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageStartingWith("jwksUri must be a valid URL");
 	}

 	@Test
@@ -274,9 +286,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.RESPONSE_TYPES_SUPPORTED));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("responseTypes cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("responseTypes cannot be null");
 	}

 	@Test
@@ -287,9 +299,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, "code");
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("responseTypes must be of type List");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("responseTypes must be of type List");
 	}

 	@Test
@@ -300,9 +312,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.RESPONSE_TYPES_SUPPORTED, Collections.emptyList());
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("responseTypes cannot be empty");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("responseTypes cannot be empty");
 	}

 	@Test
@@ -310,9 +322,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("subjectTypes cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("subjectTypes cannot be null");
 	}

 	@Test
@@ -323,9 +335,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED, "public");
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("subjectTypes must be of type List");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("subjectTypes must be of type List");
 	}

 	@Test
@@ -336,9 +348,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED, Collections.emptyList());
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("subjectTypes cannot be empty");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("subjectTypes cannot be empty");
 	}

 	@Test
@@ -346,9 +358,9 @@ public class OidcProviderConfigurationTests {
 		OidcProviderConfiguration.Builder builder = this.minimalConfigurationBuilder
 				.claims((claims) -> claims.remove(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED));

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("idTokenSigningAlgorithms cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessage("idTokenSigningAlgorithms cannot be null");
 	}

 	@Test
@@ -359,9 +371,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED, "RS256");
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("idTokenSigningAlgorithms must be of type List");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("idTokenSigningAlgorithms must be of type List");
 	}

 	@Test
@@ -372,9 +384,9 @@ public class OidcProviderConfigurationTests {
 					claims.put(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED, Collections.emptyList());
 				});

-		assertThatThrownBy(builder::build)
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessageContaining("idTokenSigningAlgorithms cannot be empty");
+		assertThatIllegalArgumentException()
+				.isThrownBy(builder::build)
+				.withMessageContaining("idTokenSigningAlgorithms cannot be empty");
 	}

 	@Test
@@ -467,16 +479,16 @@ public class OidcProviderConfigurationTests {

 	@Test
 	public void claimWhenNameIsNullThenThrowIllegalArgumentException() {
-		assertThatThrownBy(() -> OidcProviderConfiguration.builder().claim(null, "value"))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("name cannot be empty");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OidcProviderConfiguration.builder().claim(null, "value"))
+				.withMessage("name cannot be empty");
 	}

 	@Test
 	public void claimWhenValueIsNullThenThrowIllegalArgumentException() {
-		assertThatThrownBy(() -> OidcProviderConfiguration.builder().claim("claim-name", null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> OidcProviderConfiguration.builder().claim("claim-name", null))
+				.withMessage("value cannot be null");
 	}

 	@Test
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/core/oidc/http/converter/OidcProviderConfigurationHttpMessageConverterTests.java
@@ -31,7 +31,6 @@ import java.util.Map;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;

 /**
 * Tests for {@link OidcProviderConfigurationHttpMessageConverter}
@@ -205,9 +204,9 @@ public class OidcProviderConfigurationHttpMessageConverterTests {

 		MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();

-		assertThatThrownBy(() -> this.messageConverter.writeInternal(providerConfiguration, outputMessage))
-				.isInstanceOf(HttpMessageNotWritableException.class)
-				.hasMessageContaining("An error occurred writing the OpenID Provider Configuration")
-				.hasMessageContaining(errorMessage);
+		assertThatExceptionOfType(HttpMessageNotWritableException.class)
+				.isThrownBy(() -> this.messageConverter.writeInternal(providerConfiguration, outputMessage))
+				.withMessageContaining("An error occurred writing the OpenID Provider Configuration")
+				.withMessageContaining(errorMessage);
 	}
 }
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/ProviderSettingsTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/ProviderSettingsTests.java
@@ -18,7 +18,7 @@ package org.springframework.security.oauth2.server.authorization.config;
 import org.junit.Test;

 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;

 /**
 * Tests for {@link ProviderSettings}.
@@ -78,48 +78,48 @@ public class ProviderSettingsTests {
 	@Test
 	public void issuerWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.issuer(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.issuer(null))
+				.withMessage("value cannot be null");
 	}

 	@Test
 	public void authorizationEndpointWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.authorizationEndpoint(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.authorizationEndpoint(null))
+				.withMessage("value cannot be null");
 	}

 	@Test
 	public void tokenEndpointWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.tokenEndpoint(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.tokenEndpoint(null))
+				.withMessage("value cannot be null");
 	}

 	@Test
 	public void tokenRevocationEndpointWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.tokenRevocationEndpoint(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.tokenRevocationEndpoint(null))
+				.withMessage("value cannot be null");
 	}

 	@Test
 	public void tokenIntrospectionEndpointWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.tokenIntrospectionEndpoint(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.tokenIntrospectionEndpoint(null))
+				.withMessage("value cannot be null");
 	}

 	@Test
 	public void jwksEndpointWhenNullThenThrowIllegalArgumentException() {
 		ProviderSettings settings = new ProviderSettings();
-		assertThatThrownBy(() -> settings.jwkSetEndpoint(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("value cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> settings.jwkSetEndpoint(null))
+				.withMessage("value cannot be null");
 	}
 }
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilterTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilterTests.java
@@ -26,7 +26,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
@@ -41,9 +41,9 @@ public class OidcProviderConfigurationEndpointFilterTests {

 	@Test
 	public void constructorWhenProviderSettingsNullThenThrowIllegalArgumentException() {
-		assertThatThrownBy(() -> new OidcProviderConfigurationEndpointFilter(null))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("providerSettings cannot be null");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> new OidcProviderConfigurationEndpointFilter(null))
+				.withMessage("providerSettings cannot be null");
 	}

 	@Test
@@ -129,8 +129,8 @@ public class OidcProviderConfigurationEndpointFilterTests {
 		MockHttpServletResponse response = new MockHttpServletResponse();
 		FilterChain filterChain = mock(FilterChain.class);

-		assertThatThrownBy(() -> filter.doFilter(request, response, filterChain))
-				.isInstanceOf(IllegalArgumentException.class)
-				.hasMessage("issuer must be a valid URL");
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> filter.doFilter(request, response, filterChain))
+				.withMessage("issuer must be a valid URL");
 	}
 }
--- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerConfigurationEndpointFilterTests.java
+++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerConfigurationEndpointFilterTests.java
@@ -0,0 +1,141 @@
+/*
+ * Copyright 2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.server.authorization.web;
+
+
+import org.junit.Test;
+import org.springframework.http.MediaType;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;
+
+import javax.servlet.FilterChain;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+
+/**
+ * Tests for {@link OAuth2AuthorizationServerConfigurationEndpointFilter}.
+ *
+ * @author Daniel Garnier-Moiroux
+ */
+public class OAuth2AuthorizationServerConfigurationEndpointFilterTests {
+
+	@Test
+	public void constructorWhenProviderSettingsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> new OAuth2AuthorizationServerConfigurationEndpointFilter(null))
+				.withMessage("providerSettings cannot be null");
+	}
+
+	@Test
+	public void doFilterWhenNotAuthorizationServerConfigurationRequestThenNotProcessed() throws Exception {
+		OAuth2AuthorizationServerConfigurationEndpointFilter filter =
+				new OAuth2AuthorizationServerConfigurationEndpointFilter(new ProviderSettings().issuer("https://example.com"));
+
+		String requestUri = "/path";
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setServletPath(requestUri);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain filterChain = mock(FilterChain.class);
+
+		filter.doFilter(request, response, filterChain);
+
+		verify(filterChain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
+	}
+
+	@Test
+	public void doFilterWhenAuthorizationServerConfigurationRequestPostThenNotProcessed() throws Exception {
+		OAuth2AuthorizationServerConfigurationEndpointFilter filter =
+				new OAuth2AuthorizationServerConfigurationEndpointFilter(new ProviderSettings().issuer("https://example.com"));
+
+		String requestUri = OAuth2AuthorizationServerConfigurationEndpointFilter.DEFAULT_OAUTH2_AUTHORIZATION_SERVER_CONFIGURATION_ENDPOINT_URI;
+		MockHttpServletRequest request = new MockHttpServletRequest("POST", requestUri);
+		request.setServletPath(requestUri);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain filterChain = mock(FilterChain.class);
+
+		filter.doFilter(request, response, filterChain);
+
+		verify(filterChain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
+	}
+
+	@Test
+	public void doFilterWhenAuthorizationServerConfigurationRequestThenAuthorizationServerConfigurationResponse() throws Exception {
+		String authorizationEndpoint = "/oauth2/v1/authorize";
+		String tokenEndpoint = "/oauth2/v1/token";
+		String tokenRevocationEndpoint = "/oauth2/v1/revoke";
+		String jwkSetEndpoint = "/oauth2/v1/jwks";
+
+		ProviderSettings providerSettings = new ProviderSettings()
+				.issuer("https://example.com/issuer1")
+				.authorizationEndpoint(authorizationEndpoint)
+				.tokenEndpoint(tokenEndpoint)
+				.tokenRevocationEndpoint(tokenRevocationEndpoint)
+				.jwkSetEndpoint(jwkSetEndpoint);
+		OAuth2AuthorizationServerConfigurationEndpointFilter filter =
+				new OAuth2AuthorizationServerConfigurationEndpointFilter(providerSettings);
+
+		String requestUri = OAuth2AuthorizationServerConfigurationEndpointFilter.DEFAULT_OAUTH2_AUTHORIZATION_SERVER_CONFIGURATION_ENDPOINT_URI;
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setServletPath(requestUri);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain filterChain = mock(FilterChain.class);
+
+		filter.doFilter(request, response, filterChain);
+
+		verifyNoInteractions(filterChain);
+
+		assertThat(response.getContentType()).isEqualTo(MediaType.APPLICATION_JSON_VALUE);
+		String serverConfigurationResponse = response.getContentAsString();
+		assertThat(serverConfigurationResponse).contains("\"issuer\":\"https://example.com/issuer1\"");
+		assertThat(serverConfigurationResponse).contains("\"authorization_endpoint\":\"https://example.com/issuer1/oauth2/v1/authorize\"");
+		assertThat(serverConfigurationResponse).contains("\"token_endpoint\":\"https://example.com/issuer1/oauth2/v1/token\"");
+		assertThat(serverConfigurationResponse).contains("\"revocation_endpoint\":\"https://example.com/issuer1/oauth2/v1/revoke\"");
+		assertThat(serverConfigurationResponse).contains("\"jwks_uri\":\"https://example.com/issuer1/oauth2/v1/jwks\"");
+		assertThat(serverConfigurationResponse).contains("\"scopes_supported\":[\"openid\"]");
+		assertThat(serverConfigurationResponse).contains("\"response_types_supported\":[\"code\"]");
+		assertThat(serverConfigurationResponse).contains("\"grant_types_supported\":[\"authorization_code\",\"client_credentials\",\"refresh_token\"]");
+		assertThat(serverConfigurationResponse).contains("\"token_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\"]");
+		assertThat(serverConfigurationResponse).contains("\"revocation_endpoint_auth_methods_supported\":[\"client_secret_basic\",\"client_secret_post\"]");
+		assertThat(serverConfigurationResponse).contains("\"code_challenge_methods_supported\":[\"plain\",\"S256\"]");
+	}
+
+	@Test
+	public void doFilterWhenProviderSettingsWithInvalidIssuerThenThrowIllegalArgumentException() {
+		ProviderSettings providerSettings = new ProviderSettings()
+				.issuer("https://this is an invalid URL");
+		OAuth2AuthorizationServerConfigurationEndpointFilter filter =
+				new OAuth2AuthorizationServerConfigurationEndpointFilter(providerSettings);
+
+		String requestUri = OAuth2AuthorizationServerConfigurationEndpointFilter.DEFAULT_OAUTH2_AUTHORIZATION_SERVER_CONFIGURATION_ENDPOINT_URI;
+		MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
+		request.setServletPath(requestUri);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		FilterChain filterChain = mock(FilterChain.class);
+
+
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> filter.doFilter(request, response, filterChain))
+				.withMessage("issuer must be a valid URL");
+	}
+}