167 lines
11 KiB
Plaintext
167 lines
11 KiB
Plaintext
[[protocol-endpoints]]
|
|
= Protocol Endpoints
|
|
:toc: left
|
|
:toclevels: 1
|
|
|
|
[[oauth2-authorization-endpoint]]
|
|
== OAuth2 Authorization Endpoint
|
|
|
|
`OAuth2AuthorizationEndpointConfigurer` provides the ability to customize the https://datatracker.ietf.org/doc/html/rfc6749#section-3.1[OAuth2 Authorization endpoint].
|
|
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1[OAuth2 authorization requests].
|
|
|
|
`OAuth2AuthorizationEndpointConfigurer` provides the following configuration options:
|
|
|
|
[source,java]
|
|
----
|
|
@Bean
|
|
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
|
|
OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
|
|
new OAuth2AuthorizationServerConfigurer<>();
|
|
http.apply(authorizationServerConfigurer);
|
|
|
|
authorizationServerConfigurer
|
|
.authorizationEndpoint(authorizationEndpoint ->
|
|
authorizationEndpoint
|
|
.authorizationRequestConverter(authorizationRequestConverter) <1>
|
|
.authenticationProvider(authenticationProvider) <2>
|
|
.authorizationResponseHandler(authorizationResponseHandler) <3>
|
|
.errorResponseHandler(errorResponseHandler) <4>
|
|
.consentPage("/oauth2/v1/authorize") <5>
|
|
);
|
|
|
|
return http.build();
|
|
}
|
|
----
|
|
<1> `authorizationRequestConverter()`: The `AuthenticationConverter` (_pre-processor_) used when attempting to extract an https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1[OAuth2 authorization request] (or consent) from `HttpServletRequest` to an instance of `OAuth2AuthorizationCodeRequestAuthenticationToken`.
|
|
<2> `authenticationProvider()`: The `AuthenticationProvider` (_main processor_) used for authenticating the `OAuth2AuthorizationCodeRequestAuthenticationToken`. (One or more may be added to replace the defaults.)
|
|
<3> `authorizationResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OAuth2AuthorizationCodeRequestAuthenticationToken` and returning the https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2[OAuth2AuthorizationResponse].
|
|
<4> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthorizationCodeRequestAuthenticationException` and returning the https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1[OAuth2Error response].
|
|
<5> `consentPage()`: The `URI` of the custom consent page to redirect resource owners to if consent is required during the authorization request flow.
|
|
|
|
`OAuth2AuthorizationEndpointConfigurer` configures the `OAuth2AuthorizationEndpointFilter` and registers it with the OAuth2 authorization server `SecurityFilterChain` `@Bean`.
|
|
`OAuth2AuthorizationEndpointFilter` is the `Filter` that processes OAuth2 authorization requests (and consents).
|
|
|
|
`OAuth2AuthorizationEndpointFilter` is configured with the following defaults:
|
|
|
|
* `*AuthenticationConverter*` -- An `OAuth2AuthorizationCodeRequestAuthenticationConverter`.
|
|
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2AuthorizationCodeRequestAuthenticationProvider`.
|
|
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OAuth2AuthorizationCodeRequestAuthenticationToken` and returns the `OAuth2AuthorizationResponse`.
|
|
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthorizationCodeRequestAuthenticationException` and returns the `OAuth2Error` response.
|
|
|
|
[[oauth2-token-endpoint]]
|
|
== OAuth2 Token Endpoint
|
|
|
|
`OAuth2TokenEndpointConfigurer` provides the ability to customize the https://datatracker.ietf.org/doc/html/rfc6749#section-3.2[OAuth2 Token endpoint].
|
|
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3[OAuth2 access token requests].
|
|
|
|
`OAuth2TokenEndpointConfigurer` provides the following configuration options:
|
|
[source,java]
|
|
----
|
|
@Bean
|
|
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
|
|
OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
|
|
new OAuth2AuthorizationServerConfigurer<>();
|
|
http.apply(authorizationServerConfigurer);
|
|
|
|
authorizationServerConfigurer
|
|
.tokenEndpoint(tokenEndpoint ->
|
|
tokenEndpoint
|
|
.accessTokenRequestConverter(accessTokenRequestConverter) <1>
|
|
.authenticationProvider(authenticationProvider) <2>
|
|
.accessTokenResponseHandler(accessTokenResponseHandler) <3>
|
|
.errorResponseHandler(errorResponseHandler) <4>
|
|
);
|
|
|
|
return http.build();
|
|
}
|
|
----
|
|
<1> `accessTokenRequestConverter()`: The `AuthenticationConverter` (_pre-processor_) used when attempting to extract an https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3[OAuth2 access token request] from `HttpServletRequest` to an instance of `OAuth2AuthorizationGrantAuthenticationToken`.
|
|
<2> `authenticationProvider()`: The `AuthenticationProvider` (_main processor_) used for authenticating the `OAuth2AuthorizationGrantAuthenticationToken`. (One or more may be added to replace the defaults.)
|
|
<3> `accessTokenResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an `OAuth2AccessTokenAuthenticationToken` and returning the https://datatracker.ietf.org/doc/html/rfc6749#section-5.1[`OAuth2AccessTokenResponse`].
|
|
<4> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://datatracker.ietf.org/doc/html/rfc6749#section-5.2[OAuth2Error response].
|
|
|
|
`OAuth2TokenEndpointConfigurer` configures the `OAuth2TokenEndpointFilter` and registers it with the OAuth2 authorization server `SecurityFilterChain` `@Bean`.
|
|
`OAuth2TokenEndpointFilter` is the `Filter` that processes OAuth2 access token requests.
|
|
|
|
The supported https://datatracker.ietf.org/doc/html/rfc6749#section-1.3[authorization grant types] are `authorization_code`, `refresh_token`, and `client_credentials`.
|
|
|
|
`OAuth2TokenEndpointFilter` is configured with the following defaults:
|
|
|
|
* `*AuthenticationConverter*` -- A `DelegatingAuthenticationConverter` composed of `OAuth2AuthorizationCodeAuthenticationConverter`, `OAuth2RefreshTokenAuthenticationConverter`, and `OAuth2ClientCredentialsAuthenticationConverter`.
|
|
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2AuthorizationCodeAuthenticationProvider`, `OAuth2RefreshTokenAuthenticationProvider`, and `OAuth2ClientCredentialsAuthenticationProvider`.
|
|
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an `OAuth2AccessTokenAuthenticationToken` and returns the `OAuth2AccessTokenResponse`.
|
|
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
|
|
|
|
[[oauth2-token-introspection-endpoint]]
|
|
== OAuth2 Token Introspection Endpoint
|
|
|
|
`OAuth2TokenIntrospectionEndpointConfigurer` provides the ability to customize the https://tools.ietf.org/html/rfc7662[OAuth2 Token Introspection endpoint].
|
|
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://datatracker.ietf.org/doc/html/rfc7662#section-2.1[OAuth2 introspection requests].
|
|
|
|
`OAuth2TokenIntrospectionEndpointConfigurer` provides the following configuration options:
|
|
|
|
[source,java]
|
|
----
|
|
@Bean
|
|
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
|
|
OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
|
|
new OAuth2AuthorizationServerConfigurer<>();
|
|
http.apply(authorizationServerConfigurer);
|
|
|
|
authorizationServerConfigurer
|
|
.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint ->
|
|
tokenIntrospectionEndpoint
|
|
.introspectionRequestConverter(introspectionRequestConverter) <1>
|
|
.authenticationProvider(authenticationProvider) <2>
|
|
.introspectionResponseHandler(introspectionResponseHandler) <3>
|
|
.errorResponseHandler(errorResponseHandler) <4>
|
|
);
|
|
|
|
return http.build();
|
|
}
|
|
----
|
|
<1> `introspectionRequestConverter()`: The `AuthenticationConverter` (_pre-processor_) used when attempting to extract an https://datatracker.ietf.org/doc/html/rfc7662#section-2.1[OAuth2 introspection request] from `HttpServletRequest` to an instance of `OAuth2TokenIntrospectionAuthenticationToken`.
|
|
<2> `authenticationProvider()`: The `AuthenticationProvider` (_main processor_) used for authenticating the `OAuth2TokenIntrospectionAuthenticationToken`. (One or more may be added to replace the defaults.)
|
|
<3> `introspectionResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OAuth2TokenIntrospectionAuthenticationToken` and returning the https://datatracker.ietf.org/doc/html/rfc7662#section-2.2[OAuth2TokenIntrospection].
|
|
<4> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://datatracker.ietf.org/doc/html/rfc6749#section-5.2[OAuth2Error response].
|
|
|
|
`OAuth2TokenIntrospectionEndpointConfigurer` configures the `OAuth2TokenIntrospectionEndpointFilter` and registers it with the OAuth2 authorization server `SecurityFilterChain` `@Bean`.
|
|
`OAuth2TokenIntrospectionEndpointFilter` is the `Filter` that processes OAuth2 introspection requests.
|
|
|
|
`OAuth2TokenIntrospectionEndpointFilter` is configured with the following defaults:
|
|
|
|
* `*AuthenticationConverter*` -- An internal implementation that returns the `OAuth2TokenIntrospectionAuthenticationToken`.
|
|
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2TokenIntrospectionAuthenticationProvider`.
|
|
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OAuth2TokenIntrospectionAuthenticationToken` and returns the `OAuth2TokenIntrospection`.
|
|
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
|
|
|
|
[[oauth2-token-revocation-endpoint]]
|
|
== OAuth2 Token Revocation Endpoint
|
|
|
|
This section is under construction.
|
|
|
|
[[oauth2-authorization-server-metadata-endpoint]]
|
|
== OAuth2 Authorization Server Metadata Endpoint
|
|
|
|
This section is under construction.
|
|
|
|
[[jwk-set-endpoint]]
|
|
== JWK Set Endpoint
|
|
|
|
This section is under construction.
|
|
|
|
[[oidc-provider-configuration-endpoint]]
|
|
== OpenID Connect 1.0 Provider Configuration Endpoint
|
|
|
|
This section is under construction.
|
|
|
|
[[oidc-user-info-endpoint]]
|
|
== OpenID Connect 1.0 UserInfo Endpoint
|
|
|
|
This section is under construction.
|
|
|
|
[[oidc-client-registration-endpoint]]
|
|
== OpenID Connect 1.0 Client Registration Endpoint
|
|
|
|
This section is under construction.
|