Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use PasswordEncoder in OAuth2ClientAuthenticationProvider

Browse Source 
Closes gh-271
This commit is contained in:
Rafal Lewczuk
2021-03-31 10:13:23 +02:00
committed by Joe Grandja
parent 0c70e8ad3a
commit 8cd954ffa2
3 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java
View File

@@ -32,6 +32,7 @@ import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwsEncoder;
import org.springframework.security.oauth2.server.authorization.InMemoryOAuth2AuthorizationService;
@@ -158,10 +159,14 @@ public final class OAuth2AuthorizationServerConfigurer<B extends HttpSecurityBui
validateProviderSettings(providerSettings);
initEndpointMatchers(providerSettings);
PasswordEncoder passwordEncoder = getOptionalBean(builder, PasswordEncoder.class);
OAuth2ClientAuthenticationProvider clientAuthenticationProvider =
new OAuth2ClientAuthenticationProvider(
getRegisteredClientRepository(builder),
getAuthorizationService(builder));
if (passwordEncoder != null) {
clientAuthenticationProvider.setPasswordEncoder(passwordEncoder);
}
builder.authenticationProvider(postProcess(clientAuthenticationProvider));
JwtEncoder jwtEncoder = getJwtEncoder(builder);

12
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProvider.java
View File

@@ -24,6 +24,8 @@ import java.util.Map;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
import org.springframework.security.oauth2.core.OAuth2Error;
@@ -56,6 +58,7 @@ public class OAuth2ClientAuthenticationProvider implements AuthenticationProvide
private static final OAuth2TokenType AUTHORIZATION_CODE_TOKEN_TYPE = new OAuth2TokenType(OAuth2ParameterNames.CODE);
private final RegisteredClientRepository registeredClientRepository;
private final OAuth2AuthorizationService authorizationService;
private PasswordEncoder passwordEncoder;
/**
* Constructs an {@code OAuth2ClientAuthenticationProvider} using the provided parameters.
@@ -69,6 +72,12 @@ public class OAuth2ClientAuthenticationProvider implements AuthenticationProvide
Assert.notNull(authorizationService, "authorizationService cannot be null");
this.registeredClientRepository = registeredClientRepository;
this.authorizationService = authorizationService;
this.passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
}
public void setPasswordEncoder(PasswordEncoder passwordEncoder) {
Assert.notNull(passwordEncoder, "passwordEncoder cannot be null");
this.passwordEncoder = passwordEncoder;
}
@Override
@@ -91,8 +100,7 @@ public class OAuth2ClientAuthenticationProvider implements AuthenticationProvide
if (clientAuthentication.getCredentials() != null) {
String clientSecret = clientAuthentication.getCredentials().toString();
// TODO Use PasswordEncoder.matches()
if (!registeredClient.getClientSecret().equals(clientSecret)) {
if (!passwordEncoder.matches(clientSecret, registeredClient.getClientSecret())) {
throwInvalidClient();
}
authenticatedCredentials = true;

9
oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java
View File

@@ -87,6 +87,13 @@ public class OAuth2ClientAuthenticationProviderTests {
.hasMessage("authorizationService cannot be null");
}
@Test
public void constructorWhenPasswordEncoderNullThenThrowIllegalArgumentException() {
assertThatThrownBy(() -> authenticationProvider.setPasswordEncoder(null))
.isInstanceOf(IllegalArgumentException.class)
.hasMessage("passwordEncoder cannot be null");
}
@Test
public void supportsWhenTypeOAuth2ClientAuthenticationTokenThenReturnTrue() {
assertThat(this.authenticationProvider.supports(OAuth2ClientAuthenticationToken.class)).isTrue();
@@ -144,7 +151,7 @@ public class OAuth2ClientAuthenticationProviderTests {
.thenReturn(registeredClient);
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.BASIC, null);
registeredClient.getClientId(), TestRegisteredClients.CLIENT_SECRET, ClientAuthenticationMethod.BASIC, null);
OAuth2ClientAuthenticationToken authenticationResult =
(OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication);
assertThat(authenticationResult.isAuthenticated()).isTrue();