Spring/spring-authorization-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Temporarily remove validation logic for jwt token-type

Browse Source 
Issue gh-60
This commit is contained in:
Steve Riesenberg
2024-03-15 15:14:09 -05:00
parent 64882438fb
commit a483db676d
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeAuthenticationProvider.java
View File

@@ -138,7 +138,9 @@ public final class OAuth2TokenExchangeAuthenticationProvider implements Authenti
if (JWT_TOKEN_TYPE_VALUE.equals(tokenExchangeAuthentication.getSubjectTokenType()) &&
!Jwt.class.isAssignableFrom(subjectToken.getToken().getClass())) {
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
// TODO: Need a way to validate subject_token_type, since access tokens
// are always stored as OAuth2AccessToken instead of Jwt.
//throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
}
if (subjectAuthorization.getAttribute(Principal.class.getName()) == null) {
@@ -181,7 +183,9 @@ public final class OAuth2TokenExchangeAuthenticationProvider implements Authenti
if (JWT_TOKEN_TYPE_VALUE.equals(tokenExchangeAuthentication.getActorTokenType()) &&
!Jwt.class.isAssignableFrom(actorToken.getToken().getClass())) {
throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
// TODO: Need a way to validate actor_token_type, since access tokens
// are always stored as OAuth2AccessToken instead of Jwt.
//throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
}
if (StringUtils.hasText(authorizedActorSubject) &&