Skip to content

Commit fcc3a66

Browse files
frederikzfrederikz
committed
don't use AuthorizationServerSettings as a runtime object
1 parent 079054b commit fcc3a66

File tree

11 files changed

+199
-55
lines changed

11 files changed

+199
-55
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/JwtClientAssertionDecoderFactory.java

+3-5
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@
4747
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4848
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
4949
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
50-
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
5150
import org.springframework.util.Assert;
5251
import org.springframework.util.CollectionUtils;
5352
import org.springframework.util.StringUtils;
@@ -182,12 +181,11 @@ private static List<String> getAudience() {
182181
return Collections.emptyList();
183182
}
184183

185-
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext.getAuthorizationServerSettings();
186184
List<String> audience = new ArrayList<>();
187185
audience.add(authorizationServerContext.getIssuer());
188-
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerSettings.getTokenEndpoint()));
189-
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerSettings.getTokenIntrospectionEndpoint()));
190-
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerSettings.getTokenRevocationEndpoint()));
186+
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerContext.getTokenEndpoint()));
187+
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerContext.getTokenIntrospectionEndpoint()));
188+
audience.add(asUrl(authorizationServerContext.getIssuer(), authorizationServerContext.getTokenRevocationEndpoint()));
191189
return audience;
192190
}
193191

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2DeviceVerificationAuthenticationProvider.java

+1-5
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121

2222
import org.apache.commons.logging.Log;
2323
import org.apache.commons.logging.LogFactory;
24-
2524
import org.springframework.security.authentication.AnonymousAuthenticationToken;
2625
import org.springframework.security.authentication.AuthenticationProvider;
2726
import org.springframework.security.core.Authentication;
@@ -40,7 +39,6 @@
4039
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
4140
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
4241
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
43-
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
4442
import org.springframework.util.Assert;
4543

4644
/**
@@ -146,9 +144,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
146144
Set<String> currentAuthorizedScopes = currentAuthorizationConsent != null ?
147145
currentAuthorizationConsent.getScopes() : null;
148146

149-
AuthorizationServerSettings authorizationServerSettings =
150-
AuthorizationServerContextHolder.getContext().getAuthorizationServerSettings();
151-
String deviceVerificationUri = authorizationServerSettings.getDeviceVerificationEndpoint();
147+
String deviceVerificationUri = AuthorizationServerContextHolder.getContext().getDeviceVerificationEndpoint();
152148

153149
return new OAuth2DeviceAuthorizationConsentAuthenticationToken(deviceVerificationUri,
154150
registeredClient.getClientId(), principal, deviceVerificationAuthentication.getUserCode(), state,

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcConfigurer.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2626
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContext;
2727
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
28-
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
2928
import org.springframework.security.web.util.matcher.OrRequestMatcher;
3029
import org.springframework.security.web.util.matcher.RequestMatcher;
3130
import org.springframework.web.util.UriComponentsBuilder;
@@ -130,10 +129,9 @@ void configure(HttpSecurity httpSecurity) {
130129
.addDefaultProviderConfigurationCustomizer((builder) -> {
131130
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
132131
String issuer = authorizationServerContext.getIssuer();
133-
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext.getAuthorizationServerSettings();
134132

135133
String clientRegistrationEndpoint = UriComponentsBuilder.fromUriString(issuer)
136-
.path(authorizationServerSettings.getOidcClientRegistrationEndpoint()).build().toUriString();
134+
.path(authorizationServerContext.getOidcClientRegistrationEndpoint()).build().toUriString();
137135

138136
builder.clientRegistrationEndpoint(clientRegistrationEndpoint);
139137
});

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/context/AuthorizationServerContext.java

+68-3
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,75 @@ public interface AuthorizationServerContext {
3535
String getIssuer();
3636

3737
/**
38-
* Returns the {@link AuthorizationServerSettings}.
38+
* Returns the OAuth 2.0 Authorization endpoint.
3939
*
40-
* @return the {@link AuthorizationServerSettings}
40+
* @return the Authorization endpoint
4141
*/
42-
AuthorizationServerSettings getAuthorizationServerSettings();
42+
String getAuthorizationEndpoint();
43+
44+
/**
45+
* Returns the OAuth 2.0 Device Authorization endpoint.
46+
*
47+
* @return the Device Authorization endpoint
48+
* @since 1.1
49+
*/
50+
String getDeviceAuthorizationEndpoint();
51+
52+
/**
53+
* Returns the OAuth 2.0 Device Verification endpoint.
54+
*
55+
* @return the Device Verification endpoint
56+
* @since 1.1
57+
*/
58+
String getDeviceVerificationEndpoint();
59+
60+
/**
61+
* Returns the OAuth 2.0 Token endpoint.
62+
*
63+
* @return the Token endpoint
64+
*/
65+
String getTokenEndpoint();
66+
67+
/**
68+
* Returns the JWK Set endpoint.
69+
*
70+
* @return the JWK Set endpoint
71+
*/
72+
String getJwkSetEndpoint();
73+
74+
/**
75+
* Returns the OAuth 2.0 Token Revocation endpoint.
76+
*
77+
* @return the Token Revocation endpoint
78+
*/
79+
String getTokenRevocationEndpoint();
80+
81+
/**
82+
* Returns the OAuth 2.0 Token Introspection endpoint.
83+
*
84+
* @return the Token Introspection endpoint
85+
*/
86+
String getTokenIntrospectionEndpoint();
87+
88+
/**
89+
* Returns the OpenID Connect 1.0 Client Registration endpoint.
90+
*
91+
* @return the OpenID Connect 1.0 Client Registration endpoint
92+
*/
93+
String getOidcClientRegistrationEndpoint();
94+
95+
/**
96+
* Returns the OpenID Connect 1.0 UserInfo endpoint.
97+
*
98+
* @return the OpenID Connect 1.0 UserInfo endpoint
99+
*/
100+
String getOidcUserInfoEndpoint();
101+
102+
/**
103+
* Returns the OpenID Connect 1.0 Logout endpoint.
104+
*
105+
* @return the OpenID Connect 1.0 Logout endpoint
106+
*/
107+
String getOidcLogoutEndpoint();
43108

44109
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/context/DefaultAuthorizationServerContextResolver.java

+47-2
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,53 @@ public String getIssuer() {
7171
}
7272

7373
@Override
74-
public AuthorizationServerSettings getAuthorizationServerSettings() {
75-
return this.authorizationServerSettings;
74+
public String getAuthorizationEndpoint() {
75+
return authorizationServerSettings.getAuthorizationEndpoint();
76+
}
77+
78+
@Override
79+
public String getDeviceAuthorizationEndpoint() {
80+
return authorizationServerSettings.getDeviceAuthorizationEndpoint();
81+
}
82+
83+
@Override
84+
public String getDeviceVerificationEndpoint() {
85+
return authorizationServerSettings.getDeviceVerificationEndpoint();
86+
}
87+
88+
@Override
89+
public String getTokenEndpoint() {
90+
return authorizationServerSettings.getTokenEndpoint();
91+
}
92+
93+
@Override
94+
public String getJwkSetEndpoint() {
95+
return authorizationServerSettings.getJwkSetEndpoint();
96+
}
97+
98+
@Override
99+
public String getTokenRevocationEndpoint() {
100+
return authorizationServerSettings.getTokenRevocationEndpoint();
101+
}
102+
103+
@Override
104+
public String getTokenIntrospectionEndpoint() {
105+
return authorizationServerSettings.getTokenIntrospectionEndpoint();
106+
}
107+
108+
@Override
109+
public String getOidcClientRegistrationEndpoint() {
110+
return authorizationServerSettings.getOidcClientRegistrationEndpoint();
111+
}
112+
113+
@Override
114+
public String getOidcUserInfoEndpoint() {
115+
return authorizationServerSettings.getOidcUserInfoEndpoint();
116+
}
117+
118+
@Override
119+
public String getOidcLogoutEndpoint() {
120+
return authorizationServerSettings.getOidcLogoutEndpoint();
76121
}
77122

78123
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/RegisteredClientOidcClientRegistrationConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public OidcClientRegistration convert(RegisteredClient registeredClient) {
6868

6969
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
7070
String registrationClientUri = UriComponentsBuilder.fromUriString(authorizationServerContext.getIssuer())
71-
.path(authorizationServerContext.getAuthorizationServerSettings().getOidcClientRegistrationEndpoint())
71+
.path(authorizationServerContext.getOidcClientRegistrationEndpoint())
7272
.queryParam(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId())
7373
.toUriString();
7474

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java

+8-9
Original file line numberDiff line numberDiff line change
@@ -95,25 +95,24 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
9595

9696
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
9797
String issuer = authorizationServerContext.getIssuer();
98-
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext.getAuthorizationServerSettings();
9998

10099
OidcProviderConfiguration.Builder providerConfiguration = OidcProviderConfiguration.builder()
101100
.issuer(issuer)
102-
.authorizationEndpoint(asUrl(issuer, authorizationServerSettings.getAuthorizationEndpoint()))
103-
.deviceAuthorizationEndpoint(asUrl(issuer, authorizationServerSettings.getDeviceAuthorizationEndpoint()))
104-
.tokenEndpoint(asUrl(issuer, authorizationServerSettings.getTokenEndpoint()))
101+
.authorizationEndpoint(asUrl(issuer, authorizationServerContext.getAuthorizationEndpoint()))
102+
.deviceAuthorizationEndpoint(asUrl(issuer, authorizationServerContext.getDeviceAuthorizationEndpoint()))
103+
.tokenEndpoint(asUrl(issuer, authorizationServerContext.getTokenEndpoint()))
105104
.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
106-
.jwkSetUrl(asUrl(issuer, authorizationServerSettings.getJwkSetEndpoint()))
107-
.userInfoEndpoint(asUrl(issuer, authorizationServerSettings.getOidcUserInfoEndpoint()))
108-
.endSessionEndpoint(asUrl(issuer, authorizationServerSettings.getOidcLogoutEndpoint()))
105+
.jwkSetUrl(asUrl(issuer, authorizationServerContext.getJwkSetEndpoint()))
106+
.userInfoEndpoint(asUrl(issuer, authorizationServerContext.getOidcUserInfoEndpoint()))
107+
.endSessionEndpoint(asUrl(issuer, authorizationServerContext.getOidcLogoutEndpoint()))
109108
.responseType(OAuth2AuthorizationResponseType.CODE.getValue())
110109
.grantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue())
111110
.grantType(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
112111
.grantType(AuthorizationGrantType.REFRESH_TOKEN.getValue())
113112
.grantType(AuthorizationGrantType.DEVICE_CODE.getValue())
114-
.tokenRevocationEndpoint(asUrl(issuer, authorizationServerSettings.getTokenRevocationEndpoint()))
113+
.tokenRevocationEndpoint(asUrl(issuer, authorizationServerContext.getTokenRevocationEndpoint()))
115114
.tokenRevocationEndpointAuthenticationMethods(clientAuthenticationMethods())
116-
.tokenIntrospectionEndpoint(asUrl(issuer, authorizationServerSettings.getTokenIntrospectionEndpoint()))
115+
.tokenIntrospectionEndpoint(asUrl(issuer, authorizationServerContext.getTokenIntrospectionEndpoint()))
117116
.tokenIntrospectionEndpointAuthenticationMethods(clientAuthenticationMethods())
118117
.subjectType("public")
119118
.idTokenSigningAlgorithm(SignatureAlgorithm.RS256.getName())

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java

+6-7
Original file line numberDiff line numberDiff line change
@@ -108,23 +108,22 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
108108

109109
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
110110
String issuer = authorizationServerContext.getIssuer();
111-
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext.getAuthorizationServerSettings();
112111

113112
OAuth2AuthorizationServerMetadata.Builder authorizationServerMetadata = OAuth2AuthorizationServerMetadata.builder()
114113
.issuer(issuer)
115-
.authorizationEndpoint(asUrl(issuer, authorizationServerSettings.getAuthorizationEndpoint()))
116-
.deviceAuthorizationEndpoint(asUrl(issuer, authorizationServerSettings.getDeviceAuthorizationEndpoint()))
117-
.tokenEndpoint(asUrl(issuer, authorizationServerSettings.getTokenEndpoint()))
114+
.authorizationEndpoint(asUrl(issuer, authorizationServerContext.getAuthorizationEndpoint()))
115+
.deviceAuthorizationEndpoint(asUrl(issuer, authorizationServerContext.getDeviceAuthorizationEndpoint()))
116+
.tokenEndpoint(asUrl(issuer, authorizationServerContext.getTokenEndpoint()))
118117
.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
119-
.jwkSetUrl(asUrl(issuer, authorizationServerSettings.getJwkSetEndpoint()))
118+
.jwkSetUrl(asUrl(issuer, authorizationServerContext.getJwkSetEndpoint()))
120119
.responseType(OAuth2AuthorizationResponseType.CODE.getValue())
121120
.grantType(AuthorizationGrantType.AUTHORIZATION_CODE.getValue())
122121
.grantType(AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
123122
.grantType(AuthorizationGrantType.REFRESH_TOKEN.getValue())
124123
.grantType(AuthorizationGrantType.DEVICE_CODE.getValue())
125-
.tokenRevocationEndpoint(asUrl(issuer, authorizationServerSettings.getTokenRevocationEndpoint()))
124+
.tokenRevocationEndpoint(asUrl(issuer, authorizationServerContext.getTokenRevocationEndpoint()))
126125
.tokenRevocationEndpointAuthenticationMethods(clientAuthenticationMethods())
127-
.tokenIntrospectionEndpoint(asUrl(issuer, authorizationServerSettings.getTokenIntrospectionEndpoint()))
126+
.tokenIntrospectionEndpoint(asUrl(issuer, authorizationServerContext.getTokenIntrospectionEndpoint()))
128127
.tokenIntrospectionEndpointAuthenticationMethods(clientAuthenticationMethods())
129128
.codeChallengeMethod("S256");
130129

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/context/TestAuthorizationServerContext.java

+48-3
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,57 @@ public TestAuthorizationServerContext(AuthorizationServerSettings authorizationS
3636
public String getIssuer() {
3737
return this.issuerSupplier != null ?
3838
this.issuerSupplier.get() :
39-
getAuthorizationServerSettings().getIssuer();
39+
authorizationServerSettings.getIssuer();
4040
}
4141

4242
@Override
43-
public AuthorizationServerSettings getAuthorizationServerSettings() {
44-
return this.authorizationServerSettings;
43+
public String getAuthorizationEndpoint() {
44+
return authorizationServerSettings.getAuthorizationEndpoint();
45+
}
46+
47+
@Override
48+
public String getDeviceAuthorizationEndpoint() {
49+
return authorizationServerSettings.getDeviceAuthorizationEndpoint();
50+
}
51+
52+
@Override
53+
public String getDeviceVerificationEndpoint() {
54+
return authorizationServerSettings.getDeviceAuthorizationEndpoint();
55+
}
56+
57+
@Override
58+
public String getTokenEndpoint() {
59+
return authorizationServerSettings.getTokenEndpoint();
60+
}
61+
62+
@Override
63+
public String getJwkSetEndpoint() {
64+
return authorizationServerSettings.getJwkSetEndpoint();
65+
}
66+
67+
@Override
68+
public String getTokenRevocationEndpoint() {
69+
return authorizationServerSettings.getTokenRevocationEndpoint();
70+
}
71+
72+
@Override
73+
public String getTokenIntrospectionEndpoint() {
74+
return authorizationServerSettings.getTokenIntrospectionEndpoint();
75+
}
76+
77+
@Override
78+
public String getOidcClientRegistrationEndpoint() {
79+
return authorizationServerSettings.getOidcClientRegistrationEndpoint();
80+
}
81+
82+
@Override
83+
public String getOidcUserInfoEndpoint() {
84+
return authorizationServerSettings.getOidcUserInfoEndpoint();
85+
}
86+
87+
@Override
88+
public String getOidcLogoutEndpoint() {
89+
return authorizationServerSettings.getOidcLogoutEndpoint();
4590
}
4691

4792
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientConfigurationAuthenticationProviderTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -371,7 +371,7 @@ public void authenticateWhenValidAccessTokenThenReturnClientRegistration() {
371371

372372
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
373373
String expectedRegistrationClientUrl = UriComponentsBuilder.fromUriString(authorizationServerContext.getIssuer())
374-
.path(authorizationServerContext.getAuthorizationServerSettings().getOidcClientRegistrationEndpoint())
374+
.path(authorizationServerContext.getOidcClientRegistrationEndpoint())
375375
.queryParam(OAuth2ParameterNames.CLIENT_ID, registeredClient.getClientId()).toUriString();
376376

377377
assertThat(clientRegistrationResult.getRegistrationClientUrl().toString()).isEqualTo(expectedRegistrationClientUrl);

0 commit comments

Comments
 (0)