Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow user to signal that OAuth2 client is using client_credentials

Browse Source 
By configuring security.oauth2.client.grantType=client_credentials the
user signals that (even in a web application) he doesn't want to use
the auth code grant (and hence session and request scoped beans for
client context).
This commit is contained in:
Dave Syer
2016-12-20 12:54:13 +00:00
parent 851ce2286f
commit 77a1a3b3c0
2 changed files with 94 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/OAuth2AutoConfigurationTests.java
View File

@@ -21,6 +21,7 @@ import java.util.Arrays;
import java.util.List;
import com.fasterxml.jackson.databind.JsonNode;
import org.junit.Test;
import org.springframework.aop.support.AopUtils;
@@ -186,6 +187,44 @@ public class OAuth2AutoConfigurationTests {
assertThat(countBeans(OAuth2ClientContext.class)).isEqualTo(2);
}
@Test
public void testCanUseClientCredentials() {
this.context = new AnnotationConfigEmbeddedWebApplicationContext();
this.context.register(TestSecurityConfiguration.class,
MinimalSecureWebApplication.class);
EnvironmentTestUtils.addEnvironment(this.context,
"security.oauth2.client.clientId=client",
"security.oauth2.client.grantType=client_credentials");
this.context.refresh();
assertThat(context.getBean(OAuth2ClientContext.class).getAccessTokenRequest())
.isNotNull();
assertThat(countBeans(ClientCredentialsResourceDetails.class)).isEqualTo(1);
assertThat(countBeans(OAuth2ClientContext.class)).isEqualTo(1);
}
@Test
public void testCanUseClientCredentialsWithEnableOAuth2Client() {
this.context = new AnnotationConfigEmbeddedWebApplicationContext();
this.context.register(ClientConfiguration.class,
MinimalSecureWebApplication.class);
EnvironmentTestUtils.addEnvironment(this.context,
"security.oauth2.client.clientId=client",
"security.oauth2.client.grantType=client_credentials");
this.context.refresh();
// Thr primary context is fine (not session scoped):
assertThat(context.getBean(OAuth2ClientContext.class).getAccessTokenRequest())
.isNotNull();
assertThat(countBeans(ClientCredentialsResourceDetails.class)).isEqualTo(1);
/*
* Kind of a bug (should ideally be 1), but the cause is in Spring OAuth2 (there
* is no need for the extra session-scoped bean). What this test proves is that
* even if the user screws up and does @EnableOAuth2Client for client credentials,
* it will still just about work (because of the @Primary annotation on the
* Boot-created instance of OAuth2ClientContext).
*/
assertThat(countBeans(OAuth2ClientContext.class)).isEqualTo(2);
}
@Test
public void testClientIsNotAuthCode() {
AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext();