From 8daf57fdeb2cee8f24dd5ae1c5688d002501651e Mon Sep 17 00:00:00 2001 From: Andy Wilkinson Date: Thu, 10 Sep 2020 10:13:54 +0100 Subject: [PATCH] Upgrade to Spring Security 5.4.0 The commit also includes an upgrade to Nimbus JOSE JWT 9.0. Spring Security requires 9.0 and it is not backwards compatible with 8.19. Closes gh-23225 Closes gh-23242 --- .../security/oauth2/client/OAuth2ClientProperties.java | 3 ++- .../OAuth2ClientPropertiesRegistrationAdapterTests.java | 2 +- spring-boot-project/spring-boot-dependencies/build.gradle | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientProperties.java index 29535453a1..fd3c4f1b9d 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientProperties.java @@ -105,7 +105,8 @@ public class OAuth2ClientProperties { private String redirectUri; /** - * Authorization scopes. May be left blank when using a pre-defined provider. + * Authorization scopes. When left blank the provider's default scopes, if any, + * will be used. */ private Set scope; diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientPropertiesRegistrationAdapterTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientPropertiesRegistrationAdapterTests.java index a04c0838de..53adf92871 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientPropertiesRegistrationAdapterTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/OAuth2ClientPropertiesRegistrationAdapterTests.java @@ -309,7 +309,7 @@ class OAuth2ClientPropertiesRegistrationAdapterTests { assertThat(adapted.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE); assertThat(adapted.getRegistrationId()).isEqualTo("okta"); assertThat(adapted.getClientName()).isEqualTo(issuer); - assertThat(adapted.getScopes()).containsOnly("openid"); + assertThat(adapted.getScopes()).isNull(); assertThat(providerDetails.getAuthorizationUri()).isEqualTo("https://example.com/o/oauth2/v2/auth"); assertThat(providerDetails.getTokenUri()).isEqualTo("https://example.com/oauth2/v4/token"); assertThat(providerDetails.getJwkSetUri()).isEqualTo("https://example.com/oauth2/v3/certs"); diff --git a/spring-boot-project/spring-boot-dependencies/build.gradle b/spring-boot-project/spring-boot-dependencies/build.gradle index 99f9c56e46..259d9881b8 100644 --- a/spring-boot-project/spring-boot-dependencies/build.gradle +++ b/spring-boot-project/spring-boot-dependencies/build.gradle @@ -1205,7 +1205,7 @@ bom { ] } } - library("Nimbus JOSE JWT", "8.19") { + library("Nimbus JOSE JWT", "9.0") { group("com.nimbusds") { modules = [ "nimbus-jose-jwt" @@ -1623,7 +1623,7 @@ bom { ] } } - library("Spring Security", "5.4.0-RC1") { + library("Spring Security", "5.4.0") { group("org.springframework.security") { imports = [ "spring-security-bom"