From f2a2b469c4add61f911e0e4404d37621b0ea7826 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Kov=C3=A1cs?= Date: Sat, 9 May 2020 12:04:13 +0200 Subject: [PATCH] Deprecate openID 2.0 support This commit adds deprecation notice to xml schema, parser of the schema and removes fixme comments. Fixes gh-7153 --- .../http/AuthenticationConfigBuilder.java | 105 ++++++++++-------- .../security/config/spring-security-4.2.xsd | 56 +++++----- .../security/config/spring-security-5.4.rnc | 4 +- .../security/config/spring-security-5.4.xsd | 72 ++++++------ .../servlet/authentication/index.adoc | 1 - 5 files changed, 127 insertions(+), 111 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java b/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java index fcfcbb5af1..6de6a2f711 100644 --- a/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java +++ b/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java @@ -350,51 +350,7 @@ final class AuthenticationConfigBuilder { RootBeanDefinition openIDFilter = null; if (openIDLoginElt != null) { - FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser( - "/login/openid", null, - OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, - sessionStrategy, allowSessionCreation, portMapper, portResolver); - - parser.parse(openIDLoginElt, pc); - openIDFilter = parser.getFilterBean(); - openIDEntryPoint = parser.getEntryPointBean(); - openidLoginProcessingUrl = parser.getLoginProcessingUrl(); - openIDLoginPage = parser.getLoginPage(); - - List attrExElts = DomUtils.getChildElementsByTagName(openIDLoginElt, - Elements.OPENID_ATTRIBUTE_EXCHANGE); - - if (!attrExElts.isEmpty()) { - // Set up the consumer with the required attribute list - BeanDefinitionBuilder consumerBldr = BeanDefinitionBuilder - .rootBeanDefinition(OPEN_ID_CONSUMER_CLASS); - BeanDefinitionBuilder axFactory = BeanDefinitionBuilder - .rootBeanDefinition(OPEN_ID_ATTRIBUTE_FACTORY_CLASS); - ManagedMap> axMap = new ManagedMap<>(); - - for (Element attrExElt : attrExElts) { - String identifierMatch = attrExElt.getAttribute("identifier-match"); - - if (!StringUtils.hasText(identifierMatch)) { - if (attrExElts.size() > 1) { - pc.getReaderContext().error( - "You must supply an identifier-match attribute if using more" - + " than one " - + Elements.OPENID_ATTRIBUTE_EXCHANGE - + " element", attrExElt); - } - // Match anything - identifierMatch = ".*"; - } - - axMap.put(identifierMatch, parseOpenIDAttributes(attrExElt)); - } - axFactory.addConstructorArgValue(axMap); - - consumerBldr.addConstructorArgValue(axFactory.getBeanDefinition()); - openIDFilter.getPropertyValues().addPropertyValue("consumer", - consumerBldr.getBeanDefinition()); - } + openIDFilter = parseOpenIDFilter(sessionStrategy, openIDLoginElt); } if (openIDFilter != null) { @@ -412,6 +368,65 @@ final class AuthenticationConfigBuilder { } } + /** + * Parses OpenID 1.0 and 2.0 - related parts of configuration xmls + * @deprecated The OpenID 1.0 and 2.0 protocols have been deprecated and users are + * encouraged to migrate + * to OpenID Connect, which is supported by spring-security-oauth2. + * @param sessionStrategy sessionStrategy + * @param openIDLoginElt the element from the xml file + * @return the parsed filter as rootBeanDefinition + */ + private RootBeanDefinition parseOpenIDFilter( BeanReference sessionStrategy, Element openIDLoginElt ) { + RootBeanDefinition openIDFilter; + FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser( + "/login/openid", null, + OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, + sessionStrategy, allowSessionCreation, portMapper, portResolver); + + parser.parse(openIDLoginElt, pc); + openIDFilter = parser.getFilterBean(); + openIDEntryPoint = parser.getEntryPointBean(); + openidLoginProcessingUrl = parser.getLoginProcessingUrl(); + openIDLoginPage = parser.getLoginPage(); + + List attrExElts = DomUtils.getChildElementsByTagName(openIDLoginElt, + Elements.OPENID_ATTRIBUTE_EXCHANGE); + + if (!attrExElts.isEmpty()) { + // Set up the consumer with the required attribute list + BeanDefinitionBuilder consumerBldr = BeanDefinitionBuilder + .rootBeanDefinition(OPEN_ID_CONSUMER_CLASS); + BeanDefinitionBuilder axFactory = BeanDefinitionBuilder + .rootBeanDefinition(OPEN_ID_ATTRIBUTE_FACTORY_CLASS); + ManagedMap> axMap = new ManagedMap<>(); + + for (Element attrExElt : attrExElts) { + String identifierMatch = attrExElt.getAttribute("identifier-match"); + + if (!StringUtils.hasText(identifierMatch)) { + if (attrExElts.size() > 1) { + pc.getReaderContext().error( + "You must supply an identifier-match attribute if using more" + + " than one " + + Elements.OPENID_ATTRIBUTE_EXCHANGE + + " element", attrExElt); + } + // Match anything + identifierMatch = ".*"; + } + + axMap.put(identifierMatch, parseOpenIDAttributes(attrExElt)); + } + axFactory.addConstructorArgValue(axMap); + + consumerBldr.addConstructorArgValue(axFactory.getBeanDefinition()); + openIDFilter.getPropertyValues().addPropertyValue("consumer", + consumerBldr.getBeanDefinition()); + } + return openIDFilter; + } + private ManagedList parseOpenIDAttributes(Element attrExElt) { ManagedList attributes = new ManagedList<>(); for (Element attElt : DomUtils.getChildElementsByTagName(attrExElt, diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-4.2.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-4.2.xsd index d6415b79e7..83d77e1875 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-4.2.xsd +++ b/config/src/main/resources/org/springframework/security/config/spring-security-4.2.xsd @@ -131,7 +131,7 @@ - + @@ -164,7 +164,7 @@ - + @@ -433,7 +433,7 @@ - + @@ -513,7 +513,7 @@ - + @@ -573,7 +573,7 @@ - + @@ -817,13 +817,13 @@ - - - - - - - + + + + + + + @@ -1265,7 +1265,7 @@ - + @@ -1290,7 +1290,7 @@ - + @@ -1361,7 +1361,7 @@ - + @@ -1408,7 +1408,7 @@ - + @@ -1496,7 +1496,7 @@ - + Sets up an attribute exchange configuration to request specified attributes from the @@ -1695,7 +1695,7 @@ - + @@ -1711,7 +1711,7 @@ - + @@ -1767,7 +1767,7 @@ - + @@ -1814,7 +1814,7 @@ - + @@ -1912,7 +1912,7 @@ - + @@ -1945,8 +1945,8 @@ - - + + @@ -1963,7 +1963,7 @@ - + @@ -2160,7 +2160,7 @@ - + @@ -2212,7 +2212,7 @@ - + @@ -2823,4 +2823,4 @@ - + \ No newline at end of file diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc index 86c6885a99..678318e0f8 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc +++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc @@ -615,7 +615,7 @@ opaque-token.attlist &= attribute introspector-ref {xsd:token}? openid-login = - ## Sets up form login for authentication with an Open ID identity + ## Sets up form login for authentication with an Open ID identity. NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are encouraged to migrate to OpenID Connect, which is supported by spring-security-oauth2. element openid-login {form-login.attlist, user-service-ref?, attribute-exchange*} attribute-exchange = @@ -627,7 +627,7 @@ attribute-exchange.attlist &= attribute identifier-match {xsd:token}? openid-attribute = - ## Attributes used when making an OpenID AX Fetch Request + ## Attributes used when making an OpenID AX Fetch Request. NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are encouraged to migrate to OpenID Connect, which is supported by spring-security-oauth2. element openid-attribute {openid-attribute.attlist} openid-attribute.attlist &= diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd index 7b0ab2433f..775697606e 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd +++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd @@ -124,7 +124,7 @@ - + @@ -408,7 +408,7 @@ - + @@ -488,7 +488,7 @@ - + @@ -541,7 +541,7 @@ - + @@ -785,13 +785,13 @@ - - - - - - - + + + + + + + @@ -960,10 +960,11 @@ - Sets up form login for authentication with an Open ID identity. - NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are - encouraged to migrate - to OpenID Connect, which is supported by spring-security-oauth2. + Sets up form login for authentication with an Open ID identity. NOTE: The OpenID 1.0 and + 2.0 protocols have been deprecated and users are <a + href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to + migrate</a> to <a href="https://openid.net/connect/">OpenID Connect</a>, which is + supported by <code>spring-security-oauth2</code>. @@ -1239,7 +1240,7 @@ - + @@ -1264,7 +1265,7 @@ - + @@ -1321,7 +1322,7 @@ - + @@ -1368,7 +1369,7 @@ - + @@ -1881,7 +1882,7 @@ - + Sets up an attribute exchange configuration to request specified attributes from the @@ -1908,10 +1909,11 @@ - Attributes used when making an OpenID AX Fetch Request. - NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are - encouraged to migrate - to OpenID Connect, which is supported by spring-security-oauth2. + Attributes used when making an OpenID AX Fetch Request. NOTE: The OpenID 1.0 and 2.0 + protocols have been deprecated and users are <a + href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to + migrate</a> to <a href="https://openid.net/connect/">OpenID Connect</a>, which is + supported by <code>spring-security-oauth2</code>. @@ -2083,7 +2085,7 @@ - + @@ -2099,7 +2101,7 @@ - + @@ -2155,7 +2157,7 @@ - + @@ -2202,7 +2204,7 @@ - + @@ -2300,7 +2302,7 @@ - + @@ -2333,8 +2335,8 @@ - - + + @@ -2351,7 +2353,7 @@ - + @@ -2488,7 +2490,7 @@ - + @@ -2540,7 +2542,7 @@ - + @@ -3180,4 +3182,4 @@ - + \ No newline at end of file diff --git a/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/index.adoc b/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/index.adoc index 4a0b75cdb0..9536e950e6 100644 --- a/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/index.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/servlet/authentication/index.adoc @@ -33,7 +33,6 @@ This also gives a good idea of the high level flow of authentication and how pie * <> - How to remember a user past session expiration * <> - Authenticate with JAAS * <> - OpenID Authentication (not to be confused with OpenID Connect) -// FIXME: The one above is deprecated. Should it be removed from here as well? * <> - Authenticate with an external mechanism such as https://www.siteminder.com/[SiteMinder] or Java EE security but still use Spring Security for authorization and protection against common exploits. * <> - X509 Authentication