From 7eb58ee7d95484d036ab1fa1676e24228876ff2d Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Fri, 2 Feb 2018 12:37:29 -0500 Subject: [PATCH] DefaultOAuth2UserService -> assert UserInfo Uri is set Fixes gh-4992 --- .../client/userinfo/DefaultOAuth2UserService.java | 13 ++++++++++++- .../userinfo/DefaultOAuth2UserServiceTests.java | 10 ++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java index 54b938868c..8d211c000d 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java @@ -47,18 +47,29 @@ import java.util.Set; * @see DefaultOAuth2User */ public class DefaultOAuth2UserService implements OAuth2UserService { + private static final String MISSING_USER_INFO_URI_ERROR_CODE = "missing_user_info_uri"; private static final String MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE = "missing_user_name_attribute"; private NimbusUserInfoResponseClient userInfoResponseClient = new NimbusUserInfoResponseClient(); @Override public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException { Assert.notNull(userRequest, "userRequest cannot be null"); + + if (!StringUtils.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) { + OAuth2Error oauth2Error = new OAuth2Error( + MISSING_USER_INFO_URI_ERROR_CODE, + "Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " + + userRequest.getClientRegistration().getRegistrationId(), + null + ); + throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString()); + } String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName(); if (!StringUtils.hasText(userNameAttributeName)) { OAuth2Error oauth2Error = new OAuth2Error( MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE, "Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " + - userRequest.getClientRegistration().getRegistrationId(), + userRequest.getClientRegistration().getRegistrationId(), null ); throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString()); diff --git a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserServiceTests.java b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserServiceTests.java index d1c10748bf..c6262d8c14 100644 --- a/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserServiceTests.java +++ b/oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserServiceTests.java @@ -73,11 +73,21 @@ public class DefaultOAuth2UserServiceTests { this.userService.loadUser(null); } + @Test + public void loadUserWhenUserInfoUriIsNullThenThrowOAuth2AuthenticationException() { + this.exception.expect(OAuth2AuthenticationException.class); + this.exception.expectMessage(containsString("missing_user_info_uri")); + + when(this.userInfoEndpoint.getUri()).thenReturn(null); + this.userService.loadUser(new OAuth2UserRequest(this.clientRegistration, this.accessToken)); + } + @Test public void loadUserWhenUserNameAttributeNameIsNullThenThrowOAuth2AuthenticationException() { this.exception.expect(OAuth2AuthenticationException.class); this.exception.expectMessage(containsString("missing_user_name_attribute")); + when(this.userInfoEndpoint.getUri()).thenReturn("http://provider.com/user"); when(this.userInfoEndpoint.getUserNameAttributeName()).thenReturn(null); this.userService.loadUser(new OAuth2UserRequest(this.clientRegistration, this.accessToken)); }