Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix to return hashed client_secret when registering with client_secret_jwt

Browse Source 
Closes gh-1344
This commit is contained in:
Yuta Saito
2023-10-02 06:46:50 +09:00
committed by Joe Grandja
parent 647e873b30
commit 9109d3714b
2 changed files with 65 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java
View File

@@ -196,22 +196,28 @@ public final class OidcClientRegistrationAuthenticationProvider implements Authe
}
RegisteredClient registeredClient = this.registeredClientConverter.convert(clientRegistrationAuthentication.getClientRegistration());
RegisteredClient.Builder registeredClientForDBBuilder = RegisteredClient.from(registeredClient);
RegisteredClient.Builder registeredClientForResponseBuilder = RegisteredClient.from(registeredClient);
if (StringUtils.hasText(registeredClient.getClientSecret())) {
// Encode the client secret
RegisteredClient updatedRegisteredClient = RegisteredClient.from(registeredClient)
.clientSecret(this.passwordEncoder.encode(registeredClient.getClientSecret()))
.build();
this.registeredClientRepository.save(updatedRegisteredClient);
} else {
this.registeredClientRepository.save(registeredClient);
String encodedClientSecret = this.passwordEncoder.encode(registeredClient.getClientSecret());
registeredClientForDBBuilder = registeredClientForDBBuilder
.clientSecret(encodedClientSecret);
if (ClientAuthenticationMethod.CLIENT_SECRET_JWT.getValue().equals(clientRegistrationAuthentication.getClientRegistration().getTokenEndpointAuthenticationMethod())) {
registeredClientForResponseBuilder.clientSecret(encodedClientSecret);
}
}
this.registeredClientRepository.save(registeredClientForDBBuilder.build());
RegisteredClient registeredClientForResponse = registeredClientForResponseBuilder.build();
if (this.logger.isTraceEnabled()) {
this.logger.trace("Saved registered client");
}
OAuth2Authorization registeredClientAuthorization = registerAccessToken(registeredClient);
OAuth2Authorization registeredClientAuthorization = registerAccessToken(registeredClientForResponse);
// Invalidate the "initial" access token as it can only be used once
authorization = OidcAuthenticationProviderUtils.invalidate(authorization, authorization.getAccessToken().getToken());
@@ -224,7 +230,7 @@ public final class OidcClientRegistrationAuthenticationProvider implements Authe
this.logger.trace("Saved authorization with invalidated initial access token");
}
Map<String, Object> clientRegistrationClaims = this.clientRegistrationConverter.convert(registeredClient).getClaims();
Map<String, Object> clientRegistrationClaims = this.clientRegistrationConverter.convert(registeredClientForResponse).getClaims();
OidcClientRegistration clientRegistration = OidcClientRegistration.withClaims(clientRegistrationClaims)
.registrationAccessToken(registeredClientAuthorization.getAccessToken().getToken().getTokenValue())
.build();