From c4406cda675416528c609819c181040b0b153fbf Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Tue, 24 May 2022 15:40:37 -0400 Subject: [PATCH] Remove temporary HttpSessionSecurityContextRepository Issue gh-482 --- .../OAuth2AuthorizationServerConfigurer.java | 138 ------------------ .../OAuth2AuthorizationCodeGrantTests.java | 10 +- .../authorization/OidcUserInfoTests.java | 14 +- 3 files changed, 14 insertions(+), 148 deletions(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java b/oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java index 8186c4d3..1a40e59c 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java @@ -16,30 +16,17 @@ package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization; import java.net.URI; -import java.util.ArrayList; import java.util.LinkedHashMap; -import java.util.List; import java.util.Map; -import javax.servlet.AsyncContext; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletRequestWrapper; -import javax.servlet.http.HttpServletResponse; - import com.nimbusds.jose.jwk.source.JWKSource; -import org.springframework.core.annotation.AnnotationUtils; import org.springframework.http.HttpMethod; import org.springframework.http.HttpStatus; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.HttpSecurityBuilder; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.Transient; -import org.springframework.security.core.context.SecurityContext; import org.springframework.security.oauth2.core.OAuth2Token; import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService; import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; @@ -51,11 +38,7 @@ import org.springframework.security.oauth2.server.authorization.web.OAuth2Author import org.springframework.security.oauth2.server.authorization.web.ProviderContextFilter; import org.springframework.security.web.authentication.HttpStatusEntryPoint; import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter; -import org.springframework.security.web.context.HttpRequestResponseHolder; -import org.springframework.security.web.context.HttpSessionSecurityContextRepository; -import org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper; import org.springframework.security.web.context.SecurityContextPersistenceFilter; -import org.springframework.security.web.context.SecurityContextRepository; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.OrRequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher; @@ -254,127 +237,6 @@ public final class OAuth2AuthorizationServerConfigurer requestMatchers = new ArrayList<>(); - requestMatchers.add(getRequestMatcher(OAuth2TokenEndpointConfigurer.class)); - requestMatchers.add(getRequestMatcher(OAuth2TokenIntrospectionEndpointConfigurer.class)); - requestMatchers.add(getRequestMatcher(OAuth2TokenRevocationEndpointConfigurer.class)); - return new OrRequestMatcher(requestMatchers); - } - - private RequestMatcher initJwtAuthenticationRequestMatcher() { - // JwtAuthenticationToken is @Transient and is accepted by - // OidcUserInfoEndpointFilter and OidcClientRegistrationEndpointFilter - - List requestMatchers = new ArrayList<>(); - requestMatchers.add( - getConfigurer(OidcConfigurer.class) - .getConfigurer(OidcUserInfoEndpointConfigurer.class).getRequestMatcher() - ); - OidcClientRegistrationEndpointConfigurer clientRegistrationEndpointConfigurer = - getConfigurer(OidcConfigurer.class) - .getConfigurer(OidcClientRegistrationEndpointConfigurer.class); - if (clientRegistrationEndpointConfigurer != null) { - requestMatchers.add(clientRegistrationEndpointConfigurer.getRequestMatcher()); - } - return new OrRequestMatcher(requestMatchers); - } - - }; - - builder.setSharedObject(SecurityContextRepository.class, securityContextRepositoryTransientNotSaved); } @Override diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java index 57cfe4bd..35f52de0 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java @@ -127,7 +127,6 @@ import static org.hamcrest.CoreMatchers.containsString; import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.eq; import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.never; import static org.mockito.Mockito.reset; import static org.mockito.Mockito.spy; import static org.mockito.Mockito.times; @@ -669,7 +668,7 @@ public class OAuth2AuthorizationCodeGrantTests { String authorizationCode = extractParameterFromRedirectUri(mvcResult.getResponse().getRedirectedUrl(), "code"); OAuth2Authorization authorizationCodeAuthorization = this.authorizationService.findByToken(authorizationCode, AUTHORIZATION_CODE_TOKEN_TYPE); - this.mvc.perform(post(DEFAULT_TOKEN_ENDPOINT_URI) + mvcResult = this.mvc.perform(post(DEFAULT_TOKEN_ENDPOINT_URI) .params(getTokenRequestParameters(registeredClient, authorizationCodeAuthorization)) .param(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId()) .param(PkceParameterNames.CODE_VERIFIER, S256_CODE_VERIFIER)) @@ -680,9 +679,12 @@ public class OAuth2AuthorizationCodeGrantTests { .andExpect(jsonPath("$.token_type").isNotEmpty()) .andExpect(jsonPath("$.expires_in").isNotEmpty()) .andExpect(jsonPath("$.refresh_token").doesNotExist()) - .andExpect(jsonPath("$.scope").isNotEmpty()); + .andExpect(jsonPath("$.scope").isNotEmpty()) + .andReturn(); - verify(securityContextRepository, never()).saveContext(any(), any(), any()); + org.springframework.security.core.context.SecurityContext securityContext = + securityContextRepository.loadContext(mvcResult.getRequest()).get(); + assertThat(securityContext.getAuthentication()).isNull(); } private static MultiValueMap getAuthorizationRequestParameters(RegisteredClient registeredClient) { diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcUserInfoTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcUserInfoTests.java index 9c520bcd..21d86606 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcUserInfoTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcUserInfoTests.java @@ -69,13 +69,12 @@ import org.springframework.security.web.context.HttpSessionSecurityContextReposi import org.springframework.security.web.context.SecurityContextRepository; import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.ResultMatcher; -import static org.mockito.ArgumentMatchers.any; -import static org.mockito.Mockito.never; +import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.Mockito.reset; import static org.mockito.Mockito.spy; -import static org.mockito.Mockito.verify; import static org.springframework.test.web.servlet.ResultMatcher.matchAll; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; @@ -171,13 +170,16 @@ public class OidcUserInfoTests { OAuth2AccessToken accessToken = authorization.getAccessToken().getToken(); // @formatter:off - this.mvc.perform(get(DEFAULT_OIDC_USER_INFO_ENDPOINT_URI) + MvcResult mvcResult = this.mvc.perform(get(DEFAULT_OIDC_USER_INFO_ENDPOINT_URI) .header(HttpHeaders.AUTHORIZATION, "Bearer " + accessToken.getTokenValue())) .andExpect(status().is2xxSuccessful()) - .andExpect(userInfoResponse()); + .andExpect(userInfoResponse()) + .andReturn(); // @formatter:on - verify(securityContextRepository, never()).saveContext(any(), any(), any()); + org.springframework.security.core.context.SecurityContext securityContext = + securityContextRepository.loadContext(mvcResult.getRequest()).get(); + assertThat(securityContext.getAuthentication()).isNull(); } private static ResultMatcher userInfoResponse() {