From 1bfc54fe6ae6aa9c8f506e330912a288f752e4cb Mon Sep 17 00:00:00 2001 From: Steve Riesenberg Date: Tue, 11 Apr 2023 13:41:07 -0500 Subject: [PATCH] Do not require authorizationRequest for device grant Issue gh-1127 --- .../OAuth2AuthorizationConsentAuthenticationContext.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationContext.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationContext.java index c8e572c7..aed3c342 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationContext.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationConsentAuthenticationContext.java @@ -21,6 +21,7 @@ import java.util.Map; import java.util.function.Consumer; import org.springframework.lang.Nullable; +import org.springframework.security.oauth2.core.AuthorizationGrantType; import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest; import org.springframework.security.oauth2.server.authorization.OAuth2Authorization; import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsent; @@ -162,7 +163,10 @@ public final class OAuth2AuthorizationConsentAuthenticationContext implements OA Assert.notNull(get(OAuth2AuthorizationConsent.Builder.class), "authorizationConsentBuilder cannot be null"); Assert.notNull(get(RegisteredClient.class), "registeredClient cannot be null"); Assert.notNull(get(OAuth2Authorization.class), "authorization cannot be null"); - Assert.notNull(get(OAuth2AuthorizationRequest.class), "authorizationRequest cannot be null"); + OAuth2Authorization authorization = get(OAuth2Authorization.class); + if (authorization.getAuthorizationGrantType().equals(AuthorizationGrantType.AUTHORIZATION_CODE)) { + Assert.notNull(get(OAuth2AuthorizationRequest.class), "authorizationRequest cannot be null"); + } return new OAuth2AuthorizationConsentAuthenticationContext(getContext()); }