Merge branch '1.5.x'

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java

@@ -143,17 +143,6 @@ public class SpringBootWebSecurityConfiguration {
 		}
 	}
 
-	public static List<String> getIgnored(SecurityProperties security) {
-		List<String> ignored = new ArrayList<String>(security.getIgnored());
-		if (ignored.isEmpty()) {
-			ignored.addAll(DEFAULT_IGNORED);
-		}
-		else if (ignored.contains("none")) {
-			ignored.remove("none");
-		}
-		return ignored;
-	}
-
 	// Get the ignored paths in early
 	@Order(SecurityProperties.IGNORED_ORDER)
 	private static class IgnoredPathsWebSecurityConfigurerAdapter

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/ResourceServerProperties.java

@@ -35,6 +35,7 @@ import org.springframework.validation.Validator;
  * Configuration properties for OAuth2 Resources.
  *
  * @author Dave Syer
+ * @author Madhura Bhave
  * @since 1.3.0
  */
 @ConfigurationProperties(prefix = "security.oauth2.resource")
@@ -78,6 +79,8 @@ public class ResourceServerProperties implements Validator, BeanFactoryAware {
 
 	private Jwt jwt = new Jwt();
 
+	private Jwk jwk = new Jwk();
+
 	/**
 	 * The order of the filter chain used to authenticate tokens. Default puts it after
 	 * the actuator endpoints and before the default HTTP basic filter chain (catchall).
@@ -158,6 +161,14 @@ public class ResourceServerProperties implements Validator, BeanFactoryAware {
 		this.jwt = jwt;
 	}
 
+	public Jwk getJwk() {
+		return this.jwk;
+	}
+
+	public void setJwk(Jwk jwk) {
+		this.jwk = jwk;
+	}
+
 	public String getClientId() {
 		return this.clientId;
 	}
@@ -192,29 +203,40 @@ public class ResourceServerProperties implements Validator, BeanFactoryAware {
 			return;
 		}
 		ResourceServerProperties resource = (ResourceServerProperties) target;
-		if (StringUtils.hasText(this.clientId)) {
-			if (!StringUtils.hasText(this.clientSecret)) {
-				if (!StringUtils.hasText(resource.getUserInfoUri())) {
-					errors.rejectValue("userInfoUri", "missing.userInfoUri",
-							"Missing userInfoUri (no client secret available)");
-				}
-			}
-			else {
-				if (isPreferTokenInfo()
-						&& !StringUtils.hasText(resource.getTokenInfoUri())) {
-					if (StringUtils.hasText(getJwt().getKeyUri())
-							|| StringUtils.hasText(getJwt().getKeyValue())) {
-						// It's a JWT decoder
-						return;
-					}
+
+		if ((StringUtils.hasText(this.jwt.getKeyUri())
+				|| StringUtils.hasText(this.jwt.getKeyValue()))
+				&& StringUtils.hasText(this.jwk.getKeySetUri())) {
+			errors.reject("ambiguous.keyUri", "Only one of jwt.keyUri (or jwt.keyValue) and jwk.keySetUri should be configured.");
+		}
+
+		else {
+			if (StringUtils.hasText(this.clientId)) {
+				if (!StringUtils.hasText(this.clientSecret)) {
 					if (!StringUtils.hasText(resource.getUserInfoUri())) {
-						errors.rejectValue("tokenInfoUri", "missing.tokenInfoUri",
-								"Missing tokenInfoUri and userInfoUri and there is no "
-										+ "JWT verifier key");
+						errors.rejectValue("userInfoUri", "missing.userInfoUri",
+								"Missing userInfoUri (no client secret available)");
+					}
+				}
+				else {
+					if (isPreferTokenInfo()
+							&& !StringUtils.hasText(resource.getTokenInfoUri())) {
+						if (StringUtils.hasText(getJwt().getKeyUri())
+								|| StringUtils.hasText(getJwt().getKeyValue())
+								|| StringUtils.hasText(getJwk().getKeySetUri())) {
+							// It's a JWT decoder
+							return;
+						}
+						if (!StringUtils.hasText(resource.getUserInfoUri())) {
+							errors.rejectValue("tokenInfoUri", "missing.tokenInfoUri",
+									"Missing tokenInfoUri and userInfoUri and there is no "
+											+ "JWT verifier key");
+						}
 					}
 				}
 			}
 		}
+
 	}
 
 	private int countBeans(Class<?> type) {
@@ -269,4 +291,22 @@ public class ResourceServerProperties implements Validator, BeanFactoryAware {
 
 	}
 
+	public class Jwk {
+
+		/**
+		 * The URI to get verification keys to verify the JWT token.
+		 * This can be set when the authorization server returns a
+		 * set of verification keys.
+		 */
+		private String keySetUri;
+
+		public String getKeySetUri() {
+			return this.keySetUri;
+		}
+
+		public void setKeySetUri(String keySetUri) {
+			this.keySetUri = keySetUri;
+		}
+	}
+
 }

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/ResourceServerTokenServicesConfiguration.java

@@ -31,6 +31,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass;
+import org.springframework.boot.autoconfigure.condition.NoneNestedConditions;
 import org.springframework.boot.autoconfigure.condition.SpringBootCondition;
 import org.springframework.boot.bind.RelaxedPropertyResolver;
 import org.springframework.context.annotation.Bean;
@@ -61,6 +62,7 @@ import org.springframework.security.oauth2.provider.token.ResourceServerTokenSer
 import org.springframework.security.oauth2.provider.token.TokenStore;
 import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
+import org.springframework.security.oauth2.provider.token.store.jwk.JwkTokenStore;
 import org.springframework.social.connect.ConnectionFactoryLocator;
 import org.springframework.social.connect.support.OAuth2ConnectionFactory;
 import org.springframework.util.CollectionUtils;
@@ -73,6 +75,7 @@ import org.springframework.web.client.RestTemplate;
  * Configuration for an OAuth2 resource server.
  *
  * @author Dave Syer
+ * @author Madhura Bhave
  * @since 1.3.0
  */
 @Configuration
@@ -93,7 +96,7 @@ public class ResourceServerTokenServicesConfiguration {
 	}
 
 	@Configuration
-	@Conditional(NotJwtTokenCondition.class)
+	@Conditional(RemoteTokenCondition.class)
 	protected static class RemoteTokenServicesConfiguration {
 
 		@Configuration
@@ -214,6 +217,30 @@ public class ResourceServerTokenServicesConfiguration {
 
 	}
 
+	@Configuration
+	@Conditional(JwkCondition.class)
+	protected static class JwkTokenStoreConfiguration {
+
+		private final ResourceServerProperties resource;
+
+		public JwkTokenStoreConfiguration(ResourceServerProperties resource) {
+			this.resource = resource;
+		}
+
+		@Bean
+		@ConditionalOnMissingBean(ResourceServerTokenServices.class)
+		public DefaultTokenServices jwkTokenServices() {
+			DefaultTokenServices services = new DefaultTokenServices();
+			services.setTokenStore(jwkTokenStore());
+			return services;
+		}
+
+		@Bean
+		public TokenStore jwkTokenStore() {
+			return new JwkTokenStore(this.resource.getJwk().getKeySetUri());
+		}
+	}
+
 	@Configuration
 	@Conditional(JwtTokenCondition.class)
 	protected static class JwtTokenServicesConfiguration {
@@ -341,6 +368,26 @@ public class ResourceServerTokenServicesConfiguration {
 
 	}
 
+	private static class JwkCondition extends SpringBootCondition {
+
+		@Override
+		public ConditionOutcome getMatchOutcome(ConditionContext context,
+				AnnotatedTypeMetadata metadata) {
+			ConditionMessage.Builder message = ConditionMessage
+					.forCondition("OAuth JWK Condition");
+			RelaxedPropertyResolver resolver = new RelaxedPropertyResolver(
+					context.getEnvironment(), "security.oauth2.resource.jwk.");
+			String keyUri = resolver.getProperty("key-set-uri");
+			if (StringUtils.hasText(keyUri)) {
+				return ConditionOutcome
+						.match(message.foundExactly("provided jwk key set URI"));
+			}
+			return ConditionOutcome
+					.noMatch(message.didNotFind("key jwk set URI not provided").atAll());
+		}
+
+	}
+
 	private static class NotTokenInfoCondition extends SpringBootCondition {
 
 		private TokenInfoCondition tokenInfoCondition = new TokenInfoCondition();
@@ -354,17 +401,21 @@ public class ResourceServerTokenServicesConfiguration {
 
 	}
 
-	private static class NotJwtTokenCondition extends SpringBootCondition {
+	private static class RemoteTokenCondition extends NoneNestedConditions {
 
-		private JwtTokenCondition jwtTokenCondition = new JwtTokenCondition();
-
-		@Override
-		public ConditionOutcome getMatchOutcome(ConditionContext context,
-				AnnotatedTypeMetadata metadata) {
-			return ConditionOutcome
-					.inverse(this.jwtTokenCondition.getMatchOutcome(context, metadata));
+		RemoteTokenCondition() {
+			super(ConfigurationPhase.PARSE_CONFIGURATION);
 		}
 
+		@Conditional(JwtTokenCondition.class)
+		static class HasJwtConfiguration {
+
+		}
+
+		@Conditional(JwkCondition.class)
+		static class HasJwkConfiguration {
+
+		}
 	}
 
 	static class AcceptJsonRequestInterceptor implements ClientHttpRequestInterceptor {

spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/ResourceServerPropertiesTests.java

@@ -21,13 +21,21 @@ import java.util.Map;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.Test;
 
+import org.springframework.beans.factory.ListableBeanFactory;
+import org.springframework.validation.Errors;
+import org.springframework.web.context.support.StaticWebApplicationContext;
+
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyZeroInteractions;
 
 /**
  * Tests for {@link ResourceServerProperties}.
  *
  * @author Dave Syer
  * @author Vedran Pavic
+ * @author Madhura Bhave
  */
 public class ResourceServerPropertiesTests {
 
@@ -59,4 +67,36 @@ public class ResourceServerPropertiesTests {
 				.isEqualTo("http://example.com/token_key");
 	}
 
+	@Test
+	public void validateWhenBothJwtAndJwtKeyConfigurationPresentShouldFail() throws Exception {
+		this.properties.getJwk().setKeySetUri("http://my-auth-server/token_keys");
+		this.properties.getJwt().setKeyUri("http://my-auth-server/token_key");
+		setListableBeanFactory();
+		Errors errors = mock(Errors.class);
+		this.properties.validate(this.properties, errors);
+		verify(errors).reject("ambiguous.keyUri", "Only one of jwt.keyUri (or jwt.keyValue) and jwk.keySetUri should be configured.");
+
+	}
+
+	@Test
+	public void validateWhenKeySetUriProvidedShouldSucceed() throws Exception {
+		this.properties.getJwk().setKeySetUri("http://my-auth-server/token_keys");
+		setListableBeanFactory();
+		Errors errors = mock(Errors.class);
+		this.properties.validate(this.properties, errors);
+		verifyZeroInteractions(errors);
+	}
+
+	private void setListableBeanFactory() {
+		ListableBeanFactory beanFactory = new StaticWebApplicationContext() {
+			@Override
+			public String[] getBeanNamesForType(Class<?> type, boolean includeNonSingletons, boolean allowEagerInit) {
+				if (type.isAssignableFrom(ResourceServerTokenServicesConfiguration.class)) {
+					return new String[]{"ResourceServerTokenServicesConfiguration"};
+				}
+				return new String[0];
+			}
+		};
+		this.properties.setBeanFactory(beanFactory);
+	}
 }

spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/ResourceServerTokenServicesConfigurationTests.java

@@ -21,8 +21,11 @@ import java.util.List;
 import java.util.Map;
 
 import org.junit.After;
+import org.junit.Rule;
 import org.junit.Test;
+import org.junit.rules.ExpectedException;
 
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionRegistry;
 import org.springframework.boot.WebApplicationType;
@@ -62,6 +65,7 @@ import static org.mockito.Mockito.mock;
  * Tests for {@link ResourceServerTokenServicesConfiguration}.
  *
  * @author Dave Syer
+ * @author Madhura Bhave
  */
 public class ResourceServerTokenServicesConfigurationTests {
 
@@ -77,6 +81,9 @@ public class ResourceServerTokenServicesConfigurationTests {
 
 	private ConfigurableEnvironment environment = new StandardEnvironment();
 
+	@Rule
+	public ExpectedException thrown = ExpectedException.none();
+
 	@After
 	public void close() {
 		if (this.context != null) {
@@ -188,6 +195,8 @@ public class ResourceServerTokenServicesConfigurationTests {
 				.environment(this.environment).web(WebApplicationType.NONE).run();
 		DefaultTokenServices services = this.context.getBean(DefaultTokenServices.class);
 		assertThat(services).isNotNull();
+		this.thrown.expect(NoSuchBeanDefinitionException.class);
+		this.context.getBean(RemoteTokenServices.class);
 	}
 
 	@Test
@@ -200,6 +209,18 @@ public class ResourceServerTokenServicesConfigurationTests {
 		assertThat(services).isNotNull();
 	}
 
+	@Test
+	public void jwkConfiguration() throws Exception {
+		EnvironmentTestUtils.addEnvironment(this.environment,
+				"security.oauth2.resource.jwk.key-set-uri=http://my-auth-server/token_keys");
+		this.context = new SpringApplicationBuilder(ResourceConfiguration.class)
+				.environment(this.environment).web(false).run();
+		DefaultTokenServices services = this.context.getBean(DefaultTokenServices.class);
+		assertThat(services).isNotNull();
+		this.thrown.expect(NoSuchBeanDefinitionException.class);
+		this.context.getBean(RemoteTokenServices.class);
+	}
+
 	@Test
 	public void springSocialUserInfo() {
 		EnvironmentTestUtils.addEnvironment(this.environment,