From 4081d460a26701ad1828542f688ec922f110416a Mon Sep 17 00:00:00 2001 From: Martin Grossi <25255126+enlightenedmouse@users.noreply.github.com> Date: Wed, 10 Nov 2021 22:53:35 -0500 Subject: [PATCH] Adds userinfo_endpoint to oidc provider configuration Closes gh-488 --- .../AbstractOAuth2AuthorizationServerMetadata.java | 13 +++++++++++++ ...OAuth2AuthorizationServerMetadataClaimNames.java | 5 +++++ .../OidcProviderConfigurationEndpointFilter.java | 1 + ...h2AuthorizationServerMetadataEndpointFilter.java | 1 + 4 files changed, 20 insertions(+) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java index afb1d632..66916c54 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/AbstractOAuth2AuthorizationServerMetadata.java @@ -138,6 +138,16 @@ public abstract class AbstractOAuth2AuthorizationServerMetadata implements OAuth return claim(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI, jwkSetUrl); } + /** + * Use this {@code userinfo_endpoint} in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, OPTIONAL. + * + * @param userInfoEndpoint the {@code URL} of the OAuth 2.0 UserInfo Endpoint + * @return the {@link AbstractBuilder} for further configuration + */ + public B userInfoEndpoint(String userInfoEndpoint) { + return claim(OAuth2AuthorizationServerMetadataClaimNames.USER_INFO_ENDPOINT, userInfoEndpoint); + } + /** * Add this OAuth 2.0 {@code scope} to the collection of {@code scopes_supported} * in the resulting {@link AbstractOAuth2AuthorizationServerMetadata}, RECOMMENDED. @@ -343,6 +353,9 @@ public abstract class AbstractOAuth2AuthorizationServerMetadata implements OAuth if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI) != null) { validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.JWKS_URI), "jwksUri must be a valid URL"); } + if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.USER_INFO_ENDPOINT) != null) { + validateURL(getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.USER_INFO_ENDPOINT), "userInfoEndpoint must be a valid URL"); + } if (getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.SCOPES_SUPPORTED) != null) { Assert.isInstanceOf(List.class, getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.SCOPES_SUPPORTED), "scopes must be of type List"); Assert.notEmpty((List) getClaims().get(OAuth2AuthorizationServerMetadataClaimNames.SCOPES_SUPPORTED), "scopes cannot be empty"); diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimNames.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimNames.java index e6bd62be..e64d530c 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimNames.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2AuthorizationServerMetadataClaimNames.java @@ -51,6 +51,11 @@ public interface OAuth2AuthorizationServerMetadataClaimNames { */ String JWKS_URI = "jwks_uri"; + /** + * {@code userinfo_endpoint} - the {@code URL} of the OAuth 2.0 UserInfo Endpoint + */ + String USER_INFO_ENDPOINT = "userinfo_endpoint"; + /** * {@code scopes_supported} - the OAuth 2.0 {@code scope} values supported */ diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java index 12507f07..1645617c 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java @@ -88,6 +88,7 @@ public final class OidcProviderConfigurationEndpointFilter extends OncePerReques .tokenEndpoint(asUrl(issuer, this.providerSettings.getTokenEndpoint())) .tokenEndpointAuthenticationMethods(clientAuthenticationMethods()) .jwkSetUrl(asUrl(issuer, this.providerSettings.getJwkSetEndpoint())) + .userInfoEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getOidcUserInfoEndpoint())) .responseType(OAuth2AuthorizationResponseType.CODE.getValue()) .grantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()) .grantType(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue()) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java index efb690a6..10837b3b 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java @@ -86,6 +86,7 @@ public final class OAuth2AuthorizationServerMetadataEndpointFilter extends OnceP .tokenEndpoint(asUrl(issuer, this.providerSettings.getTokenEndpoint())) .tokenEndpointAuthenticationMethods(clientAuthenticationMethods()) .jwkSetUrl(asUrl(issuer, this.providerSettings.getJwkSetEndpoint())) + .userInfoEndpoint(asUrl(this.providerSettings.getIssuer(), this.providerSettings.getOidcUserInfoEndpoint())) .responseType(OAuth2AuthorizationResponseType.CODE.getValue()) .grantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue()) .grantType(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())