From f1e6ec17195f3ad736174104561bcd2d94866fb6 Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Fri, 12 Apr 2024 05:52:18 -0400 Subject: [PATCH] Use ClientAuthenticationMethod constants tls_client_auth and self_signed_tls_client_auth Issue gh-1558, gh-1559, gh-1560 --- ...ientCertificateAuthenticationProvider.java | 10 ++-- ...dcProviderConfigurationEndpointFilter.java | 4 +- .../DefaultOAuth2TokenClaimsConsumer.java | 8 +-- ...orizationServerMetadataEndpointFilter.java | 4 +- ...entCertificateAuthenticationConverter.java | 8 +-- ...ertificateAuthenticationProviderTests.java | 52 +++++++++---------- .../OAuth2ClientCredentialsGrantTests.java | 2 +- .../token/JwtGeneratorTests.java | 8 ++- .../OAuth2AccessTokenGeneratorTests.java | 6 +-- ...rtificateAuthenticationConverterTests.java | 5 +- .../config/AuthorizationServerConfig.java | 4 +- 11 files changed, 46 insertions(+), 65 deletions(-) diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/X509ClientCertificateAuthenticationProvider.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/X509ClientCertificateAuthenticationProvider.java index 9987e0aa..a5ba5b75 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/X509ClientCertificateAuthenticationProvider.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/X509ClientCertificateAuthenticationProvider.java @@ -50,10 +50,6 @@ import org.springframework.util.StringUtils; */ public final class X509ClientCertificateAuthenticationProvider implements AuthenticationProvider { private static final String ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1"; - private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("tls_client_auth"); - private static final ClientAuthenticationMethod SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("self_signed_tls_client_auth"); private final Log logger = LogFactory.getLog(getClass()); private final RegisteredClientRepository registeredClientRepository; private final CodeVerifierAuthenticator codeVerifierAuthenticator; @@ -80,8 +76,8 @@ public final class X509ClientCertificateAuthenticationProvider implements Authen OAuth2ClientAuthenticationToken clientAuthentication = (OAuth2ClientAuthenticationToken) authentication; - if (!TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod()) && - !SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod())) { + if (!ClientAuthenticationMethod.TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod()) && + !ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())) { return null; } @@ -148,7 +144,7 @@ public final class X509ClientCertificateAuthenticationProvider implements Authen private void verifyX509Certificate(OAuth2ClientAuthenticationContext clientAuthenticationContext) { OAuth2ClientAuthenticationToken clientAuthentication = clientAuthenticationContext.getAuthentication(); - if (SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod())) { + if (ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())) { this.selfSignedCertificateVerifier.accept(clientAuthenticationContext); } else { verifyX509CertificateSubjectDN(clientAuthenticationContext); diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java index 41aa8373..3c041669 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java @@ -129,8 +129,8 @@ public final class OidcProviderConfigurationEndpointFilter extends OncePerReques authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue()); authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_JWT.getValue()); authenticationMethods.add(ClientAuthenticationMethod.PRIVATE_KEY_JWT.getValue()); - authenticationMethods.add("tls_client_auth"); - authenticationMethods.add("self_signed_tls_client_auth"); + authenticationMethods.add(ClientAuthenticationMethod.TLS_CLIENT_AUTH.getValue()); + authenticationMethods.add(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.getValue()); }; } diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/DefaultOAuth2TokenClaimsConsumer.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/DefaultOAuth2TokenClaimsConsumer.java index 98edcc2a..80e8cd93 100644 --- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/DefaultOAuth2TokenClaimsConsumer.java +++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/DefaultOAuth2TokenClaimsConsumer.java @@ -34,10 +34,6 @@ import org.springframework.security.oauth2.server.authorization.authentication.O * @since 1.3 */ final class DefaultOAuth2TokenClaimsConsumer implements Consumer> { - private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("tls_client_auth"); - private static final ClientAuthenticationMethod SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("self_signed_tls_client_auth"); private final OAuth2TokenContext context; DefaultOAuth2TokenClaimsConsumer(OAuth2TokenContext context) { @@ -51,8 +47,8 @@ final class DefaultOAuth2TokenClaimsConsumer implements Consumer this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -170,7 +166,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -185,14 +181,14 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenX509CertificateNotProvidedThenThrowOAuth2AuthenticationException() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .build(); // @formatter:on when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId()))) .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, null, null); + registeredClient.getClientId(), ClientAuthenticationMethod.TLS_CLIENT_AUTH, null, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) .extracting(ex -> ((OAuth2AuthenticationException) ex).getError()) @@ -206,7 +202,7 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenPKIX509CertificateInvalidSubjectDNThenThrowOAuth2AuthenticationException() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .x509CertificateSubjectDN("CN=demo-client-sample-2,OU=Spring Samples,O=Spring,C=US") @@ -218,7 +214,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -233,7 +229,7 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenPKIX509CertificateValidThenAuthenticated() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .x509CertificateSubjectDN(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE[0].getSubjectX500Principal().getName()) @@ -245,7 +241,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE, null); OAuth2ClientAuthenticationToken authenticationResult = @@ -255,14 +251,14 @@ public class X509ClientCertificateAuthenticationProviderTests { assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId()); assertThat(authenticationResult.getCredentials()).isEqualTo(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE); assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient); - assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD); + assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.TLS_CLIENT_AUTH); } @Test public void authenticateWhenSelfSignedX509CertificateInvalidIssuerThenThrowOAuth2AuthenticationException() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .jwkSetUrl(this.clientJwkSetUrl) @@ -274,7 +270,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE, null); // PKI Certificate will have different issuer assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -289,14 +285,14 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenSelfSignedX509CertificateMissingClientJwkSetUrlThenThrowOAuth2AuthenticationException() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .build(); // @formatter:on when(this.registeredClientRepository.findByClientId(eq(registeredClient.getClientId()))) .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -311,7 +307,7 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenSelfSignedX509CertificateInvalidClientJwkSetUrlThenThrowOAuth2AuthenticationException() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .jwkSetUrl("https://this is an invalid URL") @@ -323,7 +319,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -391,7 +387,7 @@ public class X509ClientCertificateAuthenticationProviderTests { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .jwkSetUrl(this.clientJwkSetUrl) @@ -403,7 +399,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE, null); assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication)) .isInstanceOf(OAuth2AuthenticationException.class) @@ -418,7 +414,7 @@ public class X509ClientCertificateAuthenticationProviderTests { public void authenticateWhenSelfSignedX509CertificateValidThenAuthenticated() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .jwkSetUrl(this.clientJwkSetUrl) @@ -430,7 +426,7 @@ public class X509ClientCertificateAuthenticationProviderTests { .thenReturn(registeredClient); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE, null); OAuth2ClientAuthenticationToken authenticationResult = @@ -440,14 +436,14 @@ public class X509ClientCertificateAuthenticationProviderTests { assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId()); assertThat(authenticationResult.getCredentials()).isEqualTo(TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE); assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient); - assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD); + assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH); } @Test public void authenticateWhenPkceAndValidCodeVerifierThenAuthenticated() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .x509CertificateSubjectDN(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE[0].getSubjectX500Principal().getName()) @@ -467,7 +463,7 @@ public class X509ClientCertificateAuthenticationProviderTests { Map parameters = createPkceTokenParameters(S256_CODE_VERIFIER); OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken( - registeredClient.getClientId(), TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient.getClientId(), ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE, parameters); OAuth2ClientAuthenticationToken authenticationResult = @@ -478,7 +474,7 @@ public class X509ClientCertificateAuthenticationProviderTests { assertThat(authenticationResult.getPrincipal().toString()).isEqualTo(registeredClient.getClientId()); assertThat(authenticationResult.getCredentials()).isEqualTo(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE); assertThat(authenticationResult.getRegisteredClient()).isEqualTo(registeredClient); - assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD); + assertThat(authenticationResult.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.TLS_CLIENT_AUTH); } private static Map createPkceAuthorizationParametersS256() { diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientCredentialsGrantTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientCredentialsGrantTests.java index db2a0eb0..f5679124 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientCredentialsGrantTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientCredentialsGrantTests.java @@ -269,7 +269,7 @@ public class OAuth2ClientCredentialsGrantTests { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient2() - .clientAuthenticationMethod(new ClientAuthenticationMethod("tls_client_auth")) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .x509CertificateSubjectDN(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE[0].getSubjectX500Principal().getName()) diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/JwtGeneratorTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/JwtGeneratorTests.java index 063bf36f..a941ea5a 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/JwtGeneratorTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/JwtGeneratorTests.java @@ -69,8 +69,6 @@ import static org.mockito.Mockito.verify; * @author Joe Grandja */ public class JwtGeneratorTests { - private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("tls_client_auth"); private static final OAuth2TokenType ID_TOKEN_TOKEN_TYPE = new OAuth2TokenType(OidcParameterNames.ID_TOKEN); private JwtEncoder jwtEncoder; private OAuth2TokenCustomizer jwtCustomizer; @@ -134,7 +132,7 @@ public class JwtGeneratorTests { public void generateWhenAccessTokenTypeThenReturnJwt() { // @formatter:off RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings( ClientSettings.builder() .x509CertificateSubjectDN(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE[0].getSubjectX500Principal().getName()) @@ -150,7 +148,7 @@ public class JwtGeneratorTests { OAuth2Authorization authorization = TestOAuth2Authorizations.authorization(registeredClient).build(); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient, TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient, ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); @@ -346,7 +344,7 @@ public class JwtGeneratorTests { assertThat(scopes).isEqualTo(tokenContext.getAuthorizedScopes()); OAuth2ClientAuthenticationToken clientAuthentication = (OAuth2ClientAuthenticationToken) tokenContext.getAuthorizationGrant().getPrincipal(); - if (TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod()) && + if (ClientAuthenticationMethod.TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod()) && tokenContext.getRegisteredClient().getTokenSettings().isX509CertificateBoundAccessTokens()) { Map cnf = jwtClaimsSet.getClaim("cnf"); assertThat(cnf).isNotEmpty(); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/OAuth2AccessTokenGeneratorTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/OAuth2AccessTokenGeneratorTests.java index ef14c3a8..00ea098a 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/OAuth2AccessTokenGeneratorTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/token/OAuth2AccessTokenGeneratorTests.java @@ -58,8 +58,6 @@ import static org.mockito.Mockito.verify; * @author Joe Grandja */ public class OAuth2AccessTokenGeneratorTests { - private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD = - new ClientAuthenticationMethod("tls_client_auth"); private OAuth2TokenCustomizer accessTokenCustomizer; private OAuth2AccessTokenGenerator accessTokenGenerator; private AuthorizationServerContext authorizationServerContext; @@ -127,7 +125,7 @@ public class OAuth2AccessTokenGeneratorTests { .x509CertificateBoundAccessTokens(true) .build(); RegisteredClient registeredClient = TestRegisteredClients.registeredClient() - .clientAuthenticationMethod(TLS_CLIENT_AUTH_AUTHENTICATION_METHOD) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) .clientSettings(clientSettings) .tokenSettings(tokenSettings) .build(); @@ -136,7 +134,7 @@ public class OAuth2AccessTokenGeneratorTests { Authentication principal = authorization.getAttribute(Principal.class.getName()); OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken( - registeredClient, TLS_CLIENT_AUTH_AUTHENTICATION_METHOD, + registeredClient, ClientAuthenticationMethod.TLS_CLIENT_AUTH, TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE); OAuth2AuthorizationRequest authorizationRequest = authorization.getAttribute( OAuth2AuthorizationRequest.class.getName()); diff --git a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/X509ClientCertificateAuthenticationConverterTests.java b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/X509ClientCertificateAuthenticationConverterTests.java index b25c8e68..37de0fe0 100644 --- a/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/X509ClientCertificateAuthenticationConverterTests.java +++ b/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/X509ClientCertificateAuthenticationConverterTests.java @@ -22,6 +22,7 @@ import org.junit.jupiter.api.Test; import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.security.core.Authentication; import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.oauth2.core.ClientAuthenticationMethod; import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.core.OAuth2ErrorCodes; import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames; @@ -95,7 +96,7 @@ public class X509ClientCertificateAuthenticationConverterTests { OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request); assertThat(authentication.getPrincipal()).isEqualTo("client-1"); assertThat(authentication.getCredentials()).isEqualTo(TestX509Certificates.DEMO_CLIENT_PKI_CERTIFICATE); - assertThat(authentication.getClientAuthenticationMethod().getValue()).isEqualTo("tls_client_auth"); + assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.TLS_CLIENT_AUTH); assertThat(authentication.getAdditionalParameters()) .containsOnly( entry(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.AUTHORIZATION_CODE.getValue()), @@ -117,7 +118,7 @@ public class X509ClientCertificateAuthenticationConverterTests { OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request); assertThat(authentication.getPrincipal()).isEqualTo("client-1"); assertThat(authentication.getCredentials()).isEqualTo(TestX509Certificates.DEMO_CLIENT_SELF_SIGNED_CERTIFICATE); - assertThat(authentication.getClientAuthenticationMethod().getValue()).isEqualTo("self_signed_tls_client_auth"); + assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH); assertThat(authentication.getAdditionalParameters()) .containsOnly( entry(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.AUTHORIZATION_CODE.getValue()), diff --git a/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java b/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java index eaea8478..7cdd3dbd 100644 --- a/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java +++ b/samples/demo-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java @@ -168,8 +168,8 @@ public class AuthorizationServerConfig { RegisteredClient mtlsDemoClient = RegisteredClient.withId(UUID.randomUUID().toString()) .clientId("mtls-demo-client") - .clientAuthenticationMethod(new ClientAuthenticationMethod("tls_client_auth")) - .clientAuthenticationMethod(new ClientAuthenticationMethod("self_signed_tls_client_auth")) + .clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH) + .clientAuthenticationMethod(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH) .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) .scope("message.read") .scope("message.write")