From 61621c56713d3a7d56f8636cbe7254911b39c80f Mon Sep 17 00:00:00 2001 From: yonyes Date: Thu, 12 May 2022 13:47:11 +0300 Subject: [PATCH] Default authorized scope to empty for client_credentials grant Closes gh-780 --- ...2ClientCredentialsAuthenticationProvider.java | 3 ++- ...ntCredentialsAuthenticationProviderTests.java | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java index 38c336ff..e67a69a8 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java @@ -15,6 +15,7 @@ */ package org.springframework.security.oauth2.server.authorization.authentication; +import java.util.Collections; import java.util.LinkedHashSet; import java.util.Set; @@ -87,7 +88,7 @@ public final class OAuth2ClientCredentialsAuthenticationProvider implements Auth throw new OAuth2AuthenticationException(OAuth2ErrorCodes.UNAUTHORIZED_CLIENT); } - Set authorizedScopes = registeredClient.getScopes(); // Default to configured scopes + Set authorizedScopes = Collections.EMPTY_SET; // Empty by default if (!CollectionUtils.isEmpty(clientCredentialsAuthentication.getScopes())) { for (String requestedScope : clientCredentialsAuthentication.getScopes()) { if (!registeredClient.getScopes().contains(requestedScope)) { diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java index 22f57b8c..804cf8ac 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProviderTests.java @@ -211,6 +211,22 @@ public class OAuth2ClientCredentialsAuthenticationProviderTests { assertThat(accessTokenAuthentication.getAccessToken().getScopes()).isEqualTo(requestedScope); } + @Test + public void authenticateWhenNoScopeRequestedThenAccessTokenNotContainsAnyScope() { + RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build(); + OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( + registeredClient, ClientAuthenticationMethod.CLIENT_SECRET_BASIC, registeredClient.getClientSecret()); + OAuth2ClientCredentialsAuthenticationToken authentication = + new OAuth2ClientCredentialsAuthenticationToken(clientPrincipal, null, null); + + when(this.jwtEncoder.encode(any())) + .thenReturn(createJwt(Collections.singleton("mapped-scoped"))); + + OAuth2AccessTokenAuthenticationToken accessTokenAuthentication = + (OAuth2AccessTokenAuthenticationToken) this.authenticationProvider.authenticate(authentication); + assertThat(accessTokenAuthentication.getAccessToken().getScopes()).isEmpty(); + } + @Test public void authenticateWhenAccessTokenNotGeneratedThenThrowOAuth2AuthenticationException() { RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build();