Skip to content

Commit a7b256d

Browse files
frederikzfrederikz
committed
introduced AuthorizationServerContextResolver to resolve AuthorizationServerContext
1 parent 99cd1b8 commit a7b256d

File tree

4 files changed

+134
-55
lines changed

4 files changed

+134
-55
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/AuthorizationServerContextFilter.java

+11-54
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,18 @@
1616
package org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers;
1717

1818
import java.io.IOException;
19-
import java.util.function.Supplier;
20-
21-
import jakarta.servlet.FilterChain;
22-
import jakarta.servlet.ServletException;
23-
import jakarta.servlet.http.HttpServletRequest;
24-
import jakarta.servlet.http.HttpServletResponse;
2519

2620
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
2721
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
22+
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextResolver;
2823
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
29-
import org.springframework.security.web.util.UrlUtils;
3024
import org.springframework.util.Assert;
3125
import org.springframework.web.filter.OncePerRequestFilter;
32-
import org.springframework.web.util.UriComponentsBuilder;
26+
27+
import jakarta.servlet.FilterChain;
28+
import jakarta.servlet.ServletException;
29+
import jakarta.servlet.http.HttpServletRequest;
30+
import jakarta.servlet.http.HttpServletResponse;
3331

3432
/**
3533
* A {@code Filter} that associates the {@link AuthorizationServerContext} to the {@link AuthorizationServerContextHolder}.
@@ -41,65 +39,24 @@
4139
* @see AuthorizationServerSettings
4240
*/
4341
final class AuthorizationServerContextFilter extends OncePerRequestFilter {
44-
private final AuthorizationServerSettings authorizationServerSettings;
42+
private final AuthorizationServerContextResolver authorizationServerContextResolver;
4543

46-
AuthorizationServerContextFilter(AuthorizationServerSettings authorizationServerSettings) {
47-
Assert.notNull(authorizationServerSettings, "authorizationServerSettings cannot be null");
48-
this.authorizationServerSettings = authorizationServerSettings;
44+
AuthorizationServerContextFilter(AuthorizationServerContextResolver authorizationServerContextResolver) {
45+
Assert.notNull(authorizationServerContextResolver, "authorizationServerContextResolver cannot be null");
46+
this.authorizationServerContextResolver = authorizationServerContextResolver;
4947
}
5048

5149
@Override
5250
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
5351
throws ServletException, IOException {
5452

5553
try {
56-
AuthorizationServerContext authorizationServerContext =
57-
new DefaultAuthorizationServerContext(
58-
() -> resolveIssuer(this.authorizationServerSettings, request),
59-
this.authorizationServerSettings);
54+
AuthorizationServerContext authorizationServerContext = authorizationServerContextResolver.resolve(request);
6055
AuthorizationServerContextHolder.setContext(authorizationServerContext);
6156
filterChain.doFilter(request, response);
6257
} finally {
6358
AuthorizationServerContextHolder.resetContext();
6459
}
6560
}
6661

67-
private static String resolveIssuer(AuthorizationServerSettings authorizationServerSettings, HttpServletRequest request) {
68-
return authorizationServerSettings.getIssuer() != null ?
69-
authorizationServerSettings.getIssuer() :
70-
getContextPath(request);
71-
}
72-
73-
private static String getContextPath(HttpServletRequest request) {
74-
// @formatter:off
75-
return UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
76-
.replacePath(request.getContextPath())
77-
.replaceQuery(null)
78-
.fragment(null)
79-
.build()
80-
.toUriString();
81-
// @formatter:on
82-
}
83-
84-
private static final class DefaultAuthorizationServerContext implements AuthorizationServerContext {
85-
private final Supplier<String> issuerSupplier;
86-
private final AuthorizationServerSettings authorizationServerSettings;
87-
88-
private DefaultAuthorizationServerContext(Supplier<String> issuerSupplier, AuthorizationServerSettings authorizationServerSettings) {
89-
this.issuerSupplier = issuerSupplier;
90-
this.authorizationServerSettings = authorizationServerSettings;
91-
}
92-
93-
@Override
94-
public String getIssuer() {
95-
return this.issuerSupplier.get();
96-
}
97-
98-
@Override
99-
public AuthorizationServerSettings getAuthorizationServerSettings() {
100-
return this.authorizationServerSettings;
101-
}
102-
103-
}
104-
10562
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerConfigurer.java

+20-1
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@
4545
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationException;
4646
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationToken;
4747
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
48+
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextResolver;
49+
import org.springframework.security.oauth2.server.authorization.context.DefaultAuthorizationServerContextResolver;
4850
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
4951
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
5052
import org.springframework.security.oauth2.server.authorization.web.NimbusJwkSetEndpointFilter;
@@ -85,6 +87,7 @@ public final class OAuth2AuthorizationServerConfigurer
8587

8688
private final Map<Class<? extends AbstractOAuth2Configurer>, AbstractOAuth2Configurer> configurers = createConfigurers();
8789
private RequestMatcher endpointsMatcher;
90+
private AuthorizationServerContextResolver authorizationServerContextResolver;
8891

8992

9093
/**
@@ -148,6 +151,18 @@ public OAuth2AuthorizationServerConfigurer tokenGenerator(OAuth2TokenGenerator<?
148151
return this;
149152
}
150153

154+
/**
155+
* Sets the authorization server context resolver
156+
*
157+
* @param authorizationServerContextResolver the authorization server context resolver
158+
* @return the {@link OAuth2AuthorizationServerConfigurer} for further configuration
159+
*/
160+
public OAuth2AuthorizationServerConfigurer authorizationServerContextResolver(AuthorizationServerContextResolver authorizationServerContextResolver) {
161+
Assert.notNull(authorizationServerContextResolver, "authorizationServerContextResolver cannot be null");
162+
this.authorizationServerContextResolver = authorizationServerContextResolver;
163+
return this;
164+
}
165+
151166
/**
152167
* Configures OAuth 2.0 Client Authentication.
153168
*
@@ -336,7 +351,11 @@ public void configure(HttpSecurity httpSecurity) {
336351

337352
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
338353

339-
AuthorizationServerContextFilter authorizationServerContextFilter = new AuthorizationServerContextFilter(authorizationServerSettings);
354+
AuthorizationServerContextResolver authServerContextResolver = this.authorizationServerContextResolver == null
355+
? new DefaultAuthorizationServerContextResolver(authorizationServerSettings)
356+
: this.authorizationServerContextResolver;
357+
358+
AuthorizationServerContextFilter authorizationServerContextFilter = new AuthorizationServerContextFilter(authServerContextResolver);
340359
httpSecurity.addFilterAfter(postProcess(authorizationServerContextFilter), SecurityContextHolderFilter.class);
341360

342361
JWKSource<com.nimbusds.jose.proc.SecurityContext> jwkSource = OAuth2ConfigurerUtils.getJwkSource(httpSecurity);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/context/AuthorizationServerContextResolver.java

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
* Copyright 2020-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.oauth2.server.authorization.context;
17+
18+
import jakarta.servlet.http.HttpServletRequest;
19+
20+
public interface AuthorizationServerContextResolver {
21+
22+
AuthorizationServerContext resolve(HttpServletRequest request);
23+
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/context/DefaultAuthorizationServerContextResolver.java

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
/*
2+
* Copyright 2020-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.oauth2.server.authorization.context;
17+
18+
import java.util.function.Supplier;
19+
20+
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
21+
import org.springframework.security.web.util.UrlUtils;
22+
import org.springframework.web.util.UriComponentsBuilder;
23+
24+
import jakarta.servlet.http.HttpServletRequest;
25+
26+
public class DefaultAuthorizationServerContextResolver implements AuthorizationServerContextResolver {
27+
private final AuthorizationServerSettings authorizationServerSettings;
28+
29+
public DefaultAuthorizationServerContextResolver(AuthorizationServerSettings authorizationServerSettings) {
30+
this.authorizationServerSettings = authorizationServerSettings;
31+
}
32+
33+
@Override
34+
public AuthorizationServerContext resolve(HttpServletRequest request) {
35+
AuthorizationServerContext authorizationServerContext =
36+
new DefaultAuthorizationServerContext(
37+
() -> resolveIssuer(this.authorizationServerSettings, request),
38+
this.authorizationServerSettings);
39+
return authorizationServerContext;
40+
}
41+
42+
private static String resolveIssuer(AuthorizationServerSettings authorizationServerSettings, HttpServletRequest request) {
43+
return authorizationServerSettings.getIssuer() != null ?
44+
authorizationServerSettings.getIssuer() :
45+
getContextPath(request);
46+
}
47+
48+
private static String getContextPath(HttpServletRequest request) {
49+
// @formatter:off
50+
return UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
51+
.replacePath(request.getContextPath())
52+
.replaceQuery(null)
53+
.fragment(null)
54+
.build()
55+
.toUriString();
56+
// @formatter:on
57+
}
58+
59+
private static final class DefaultAuthorizationServerContext implements AuthorizationServerContext {
60+
private final Supplier<String> issuerSupplier;
61+
private final AuthorizationServerSettings authorizationServerSettings;
62+
63+
private DefaultAuthorizationServerContext(Supplier<String> issuerSupplier, AuthorizationServerSettings authorizationServerSettings) {
64+
this.issuerSupplier = issuerSupplier;
65+
this.authorizationServerSettings = authorizationServerSettings;
66+
}
67+
68+
@Override
69+
public String getIssuer() {
70+
return this.issuerSupplier.get();
71+
}
72+
73+
@Override
74+
public AuthorizationServerSettings getAuthorizationServerSettings() {
75+
return this.authorizationServerSettings;
76+
}
77+
78+
}
79+
80+
}

0 commit comments

Comments
 (0)