diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java index 111af46596..81e9795d0b 100644 --- a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java +++ b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospector.java @@ -40,6 +40,7 @@ import org.springframework.http.client.support.BasicAuthenticationInterceptor; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal; +import org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames; import org.springframework.util.Assert; import org.springframework.util.LinkedMultiValueMap; import org.springframework.util.MultiValueMap; @@ -158,7 +159,7 @@ public class SpringOpaqueTokenIntrospector implements OpaqueTokenIntrospector { Map claims = responseEntity.getBody(); // relying solely on the authorization server to validate this token (not checking // 'exp', for example) - boolean active = (boolean) claims.compute(OAuth2IntrospectionClaimNames.ACTIVE, (k, v) -> { + boolean active = (boolean) claims.compute(OAuth2TokenIntrospectionClaimNames.ACTIVE, (k, v) -> { if (v instanceof String) { return Boolean.parseBoolean((String) v); } @@ -175,22 +176,22 @@ public class SpringOpaqueTokenIntrospector implements OpaqueTokenIntrospector { } private OAuth2AuthenticatedPrincipal convertClaimsSet(Map claims) { - claims.computeIfPresent(OAuth2IntrospectionClaimNames.AUDIENCE, (k, v) -> { + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.AUD, (k, v) -> { if (v instanceof String) { return Collections.singletonList(v); } return v; }); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.CLIENT_ID, (k, v) -> v.toString()); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.EXPIRES_AT, + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.CLIENT_ID, (k, v) -> v.toString()); + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.EXP, (k, v) -> Instant.ofEpochSecond(((Number) v).longValue())); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.ISSUED_AT, + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.IAT, (k, v) -> Instant.ofEpochSecond(((Number) v).longValue())); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.ISSUER, (k, v) -> issuer(v.toString())); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.NOT_BEFORE, + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.ISS, (k, v) -> issuer(v.toString())); + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.NBF, (k, v) -> Instant.ofEpochSecond(((Number) v).longValue())); Collection authorities = new ArrayList<>(); - claims.computeIfPresent(OAuth2IntrospectionClaimNames.SCOPE, (k, v) -> { + claims.computeIfPresent(OAuth2TokenIntrospectionClaimNames.SCOPE, (k, v) -> { if (v instanceof String) { Collection scopes = Arrays.asList(((String) v).split(" ")); for (String scope : scopes) { @@ -209,7 +210,7 @@ public class SpringOpaqueTokenIntrospector implements OpaqueTokenIntrospector { } catch (Exception ex) { throw new OAuth2IntrospectionException( - "Invalid " + OAuth2IntrospectionClaimNames.ISSUER + " value: " + uri); + "Invalid " + OAuth2TokenIntrospectionClaimNames.ISS + " value: " + uri); } } diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospectorTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospectorTests.java index 7a49839a8d..0fd6a4934f 100644 --- a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospectorTests.java +++ b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/introspection/SpringOpaqueTokenIntrospectorTests.java @@ -41,6 +41,7 @@ import org.springframework.http.MediaType; import org.springframework.http.RequestEntity; import org.springframework.http.ResponseEntity; import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal; +import org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames; import org.springframework.web.client.RestOperations; import static org.assertj.core.api.Assertions.assertThat; @@ -144,15 +145,15 @@ public class SpringOpaqueTokenIntrospectorTests { // @formatter:off assertThat(authority.getAttributes()) .isNotNull() - .containsEntry(OAuth2IntrospectionClaimNames.ACTIVE, true) - .containsEntry(OAuth2IntrospectionClaimNames.AUDIENCE, + .containsEntry(OAuth2TokenIntrospectionClaimNames.ACTIVE, true) + .containsEntry(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("https://protected.example.net/resource")) - .containsEntry(OAuth2IntrospectionClaimNames.CLIENT_ID, "l238j323ds-23ij4") - .containsEntry(OAuth2IntrospectionClaimNames.EXPIRES_AT, Instant.ofEpochSecond(1419356238)) - .containsEntry(OAuth2IntrospectionClaimNames.ISSUER, new URL("https://server.example.com/")) - .containsEntry(OAuth2IntrospectionClaimNames.SCOPE, Arrays.asList("read", "write", "dolphin")) - .containsEntry(OAuth2IntrospectionClaimNames.SUBJECT, "Z5O3upPC88QrAjx00dis") - .containsEntry(OAuth2IntrospectionClaimNames.USERNAME, "jdoe") + .containsEntry(OAuth2TokenIntrospectionClaimNames.CLIENT_ID, "l238j323ds-23ij4") + .containsEntry(OAuth2TokenIntrospectionClaimNames.EXP, Instant.ofEpochSecond(1419356238)) + .containsEntry(OAuth2TokenIntrospectionClaimNames.ISS, new URL("https://server.example.com/")) + .containsEntry(OAuth2TokenIntrospectionClaimNames.SCOPE, Arrays.asList("read", "write", "dolphin")) + .containsEntry(OAuth2TokenIntrospectionClaimNames.SUB, "Z5O3upPC88QrAjx00dis") + .containsEntry(OAuth2TokenIntrospectionClaimNames.USERNAME, "jdoe") .containsEntry("extension_field", "twenty-seven"); // @formatter:on } @@ -186,9 +187,9 @@ public class SpringOpaqueTokenIntrospectorTests { @Test public void introspectWhenActiveTokenThenParsesValuesInResponse() { Map introspectedValues = new HashMap<>(); - introspectedValues.put(OAuth2IntrospectionClaimNames.ACTIVE, true); - introspectedValues.put(OAuth2IntrospectionClaimNames.AUDIENCE, Arrays.asList("aud")); - introspectedValues.put(OAuth2IntrospectionClaimNames.NOT_BEFORE, 29348723984L); + introspectedValues.put(OAuth2TokenIntrospectionClaimNames.ACTIVE, true); + introspectedValues.put(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("aud")); + introspectedValues.put(OAuth2TokenIntrospectionClaimNames.NBF, 29348723984L); RestOperations restOperations = mock(RestOperations.class); OpaqueTokenIntrospector introspectionClient = new SpringOpaqueTokenIntrospector(INTROSPECTION_URL, restOperations); @@ -198,11 +199,11 @@ public class SpringOpaqueTokenIntrospectorTests { // @formatter:off assertThat(authority.getAttributes()) .isNotNull() - .containsEntry(OAuth2IntrospectionClaimNames.ACTIVE, true) - .containsEntry(OAuth2IntrospectionClaimNames.AUDIENCE, Arrays.asList("aud")) - .containsEntry(OAuth2IntrospectionClaimNames.NOT_BEFORE, Instant.ofEpochSecond(29348723984L)) - .doesNotContainKey(OAuth2IntrospectionClaimNames.CLIENT_ID) - .doesNotContainKey(OAuth2IntrospectionClaimNames.SCOPE); + .containsEntry(OAuth2TokenIntrospectionClaimNames.ACTIVE, true) + .containsEntry(OAuth2TokenIntrospectionClaimNames.AUD, Arrays.asList("aud")) + .containsEntry(OAuth2TokenIntrospectionClaimNames.NBF, Instant.ofEpochSecond(29348723984L)) + .doesNotContainKey(OAuth2TokenIntrospectionClaimNames.CLIENT_ID) + .doesNotContainKey(OAuth2TokenIntrospectionClaimNames.SCOPE); // @formatter:on }