Skip to content

Commit dadbf48

Browse files
bibibiu2017bibibiu2017
committed
changed: BASIC or POST to CLIENT_SECRET_BASIC or CLIENT_SECRET_POST respectively when a client is registered.
Closes gh-346
1 parent 687f03f commit dadbf48

File tree

11 files changed

+72
-25
lines changed

11 files changed

+72
-25
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java

+14-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
* limitations under the License.
1515
*/
1616
package org.springframework.security.oauth2.server.authorization.client;
17-
1817
import java.io.Serializable;
1918
import java.net.URI;
2019
import java.net.URISyntaxException;
@@ -35,6 +34,8 @@
3534
import org.springframework.util.CollectionUtils;
3635
import org.springframework.util.StringUtils;
3736

37+
38+
3839
/**
3940
* A representation of a client registration with an OAuth 2.0 Authorization Server.
4041
*
@@ -486,6 +487,7 @@ public RegisteredClient build() {
486487
}
487488
validateScopes();
488489
validateRedirectUris();
490+
upgradeClientAuthenticationMethods();
489491
return create();
490492
}
491493

@@ -544,6 +546,17 @@ private void validateRedirectUris() {
544546
}
545547
}
546548

549+
private void upgradeClientAuthenticationMethods() {
550+
if (this.clientAuthenticationMethods.contains(ClientAuthenticationMethod.BASIC)) {
551+
this.clientAuthenticationMethods.remove(ClientAuthenticationMethod.BASIC);
552+
this.clientAuthenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
553+
}
554+
if (this.clientAuthenticationMethods.contains(ClientAuthenticationMethod.POST)) {
555+
this.clientAuthenticationMethods.remove(ClientAuthenticationMethod.POST);
556+
this.clientAuthenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST);
557+
}
558+
}
559+
547560
private static boolean validateRedirectUri(String redirectUri) {
548561
try {
549562
URI validRedirectUri = new URI(redirectUri);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/ClientSecretBasicAuthenticationConverter.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020 the original author or authors.
2+
* Copyright 2020-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -86,7 +86,7 @@ public Authentication convert(HttpServletRequest request) {
8686
throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST), ex);
8787
}
8888

89-
return new OAuth2ClientAuthenticationToken(clientID, clientSecret, ClientAuthenticationMethod.BASIC,
89+
return new OAuth2ClientAuthenticationToken(clientID, clientSecret, ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
9090
extractAdditionalParameters(request));
9191
}
9292

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/ClientSecretPostAuthenticationConverter.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020 the original author or authors.
2+
* Copyright 2020-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -67,7 +67,7 @@ public Authentication convert(HttpServletRequest request) {
6767
throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST));
6868
}
6969

70-
return new OAuth2ClientAuthenticationToken(clientId, clientSecret, ClientAuthenticationMethod.POST,
70+
return new OAuth2ClientAuthenticationToken(clientId, clientSecret, ClientAuthenticationMethod.CLIENT_SECRET_POST,
7171
extractAdditionalParameters(request));
7272
}
7373

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcClientRegistrationTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ public void requestWhenClientRegistrationRequestAuthorizedThenClientRegistration
190190
assertThat(clientRegistrationResponse.getScopes())
191191
.containsExactlyInAnyOrderElementsOf(clientRegistration.getScopes());
192192
assertThat(clientRegistrationResponse.getTokenEndpointAuthenticationMethod())
193-
.isEqualTo(ClientAuthenticationMethod.BASIC.getValue());
193+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.getValue());
194194
assertThat(clientRegistrationResponse.getIdTokenSignedResponseAlgorithm())
195195
.isEqualTo(SignatureAlgorithm.RS256.getName());
196196
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProviderTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ public void authenticateWhenClientPrincipalNotOAuth2ClientAuthenticationTokenThe
132132
public void authenticateWhenClientPrincipalNotAuthenticatedThenThrowOAuth2AuthenticationException() {
133133
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
134134
OAuth2ClientAuthenticationToken clientPrincipal = new OAuth2ClientAuthenticationToken(
135-
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.BASIC, null);
135+
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null);
136136
OAuth2AuthorizationCodeAuthenticationToken authentication =
137137
new OAuth2AuthorizationCodeAuthenticationToken(AUTHORIZATION_CODE, clientPrincipal, null, null);
138138
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientAuthenticationProviderTests.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ public void authenticateWhenInvalidClientIdThenThrowOAuth2AuthenticationExceptio
124124
.thenReturn(registeredClient);
125125

126126
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
127-
registeredClient.getClientId() + "-invalid", registeredClient.getClientSecret(), ClientAuthenticationMethod.BASIC, null);
127+
registeredClient.getClientId() + "-invalid", registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null);
128128
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
129129
.isInstanceOf(OAuth2AuthenticationException.class)
130130
.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
@@ -139,7 +139,7 @@ public void authenticateWhenInvalidClientSecretThenThrowOAuth2AuthenticationExce
139139
.thenReturn(registeredClient);
140140

141141
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
142-
registeredClient.getClientId(), registeredClient.getClientSecret() + "-invalid", ClientAuthenticationMethod.BASIC, null);
142+
registeredClient.getClientId(), registeredClient.getClientSecret() + "-invalid", ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null);
143143
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
144144
.isInstanceOf(OAuth2AuthenticationException.class)
145145
.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())
@@ -170,7 +170,7 @@ public void authenticateWhenValidCredentialsThenAuthenticated() {
170170
.thenReturn(registeredClient);
171171

172172
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
173-
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.BASIC, null);
173+
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_BASIC, null);
174174
OAuth2ClientAuthenticationToken authenticationResult =
175175
(OAuth2ClientAuthenticationToken) this.authenticationProvider.authenticate(authentication);
176176

@@ -416,7 +416,7 @@ public void authenticateWhenClientAuthenticationMethodNotConfiguredThenThrowOAut
416416
.thenReturn(registeredClient);
417417

418418
OAuth2ClientAuthenticationToken authentication = new OAuth2ClientAuthenticationToken(
419-
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.POST, null);
419+
registeredClient.getClientId(), registeredClient.getClientSecret(), ClientAuthenticationMethod.CLIENT_SECRET_POST, null);
420420
assertThatThrownBy(() -> this.authenticationProvider.authenticate(authentication))
421421
.isInstanceOf(OAuth2AuthenticationException.class)
422422
.extracting(ex -> ((OAuth2AuthenticationException) ex).getError())

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClientTests.java

+38-4
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public class RegisteredClientTests {
4343
private static final Set<String> SCOPES = Collections.unmodifiableSet(
4444
Stream.of("openid", "profile", "email").collect(Collectors.toSet()));
4545
private static final Set<ClientAuthenticationMethod> CLIENT_AUTHENTICATION_METHODS =
46-
Collections.singleton(ClientAuthenticationMethod.BASIC);
46+
Collections.singleton(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
4747

4848
@Test
4949
public void buildWhenAuthorizationGrantTypesNotSetThenThrowIllegalArgumentException() {
@@ -146,7 +146,7 @@ public void buildWhenClientAuthenticationMethodNotProvidedThenDefaultToBasic() {
146146
.build();
147147

148148
assertThat(registration.getClientAuthenticationMethods())
149-
.isEqualTo(Collections.singleton(ClientAuthenticationMethod.BASIC));
149+
.isEqualTo(Collections.singleton(ClientAuthenticationMethod.CLIENT_SECRET_BASIC));
150150
}
151151

152152
@Test
@@ -280,6 +280,22 @@ public void buildWhenAuthorizationGrantTypesConsumerClearsSetThenThrowIllegalArg
280280

281281
@Test
282282
public void buildWhenTwoClientAuthenticationMethodsAreProvidedThenBothAreRegistered() {
283+
RegisteredClient registration = RegisteredClient.withId(ID)
284+
.clientId(CLIENT_ID)
285+
.clientSecret(CLIENT_SECRET)
286+
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
287+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
288+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
289+
.redirectUris(redirectUris -> redirectUris.addAll(REDIRECT_URIS))
290+
.scopes(scopes -> scopes.addAll(SCOPES))
291+
.build();
292+
293+
assertThat(registration.getClientAuthenticationMethods())
294+
.containsExactlyInAnyOrder(ClientAuthenticationMethod.CLIENT_SECRET_BASIC, ClientAuthenticationMethod.CLIENT_SECRET_POST);
295+
}
296+
297+
@Test
298+
public void buildWhenBothDeprecatedClientAuthenticationMethodsAreProvidedThenBothNonDeprecatedAreRegistered() {
283299
RegisteredClient registration = RegisteredClient.withId(ID)
284300
.clientId(CLIENT_ID)
285301
.clientSecret(CLIENT_SECRET)
@@ -291,11 +307,29 @@ public void buildWhenTwoClientAuthenticationMethodsAreProvidedThenBothAreRegiste
291307
.build();
292308

293309
assertThat(registration.getClientAuthenticationMethods())
294-
.containsExactlyInAnyOrder(ClientAuthenticationMethod.BASIC, ClientAuthenticationMethod.POST);
310+
.containsExactlyInAnyOrder(ClientAuthenticationMethod.CLIENT_SECRET_BASIC, ClientAuthenticationMethod.CLIENT_SECRET_POST);
295311
}
296312

297313
@Test
298314
public void buildWhenClientAuthenticationMethodsConsumerIsProvidedThenConsumerAccepted() {
315+
RegisteredClient registration = RegisteredClient.withId(ID)
316+
.clientId(CLIENT_ID)
317+
.clientSecret(CLIENT_SECRET)
318+
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
319+
.clientAuthenticationMethods(clientAuthenticationMethods -> {
320+
clientAuthenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
321+
clientAuthenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST);
322+
})
323+
.redirectUris(redirectUris -> redirectUris.addAll(REDIRECT_URIS))
324+
.scopes(scopes -> scopes.addAll(SCOPES))
325+
.build();
326+
327+
assertThat(registration.getClientAuthenticationMethods())
328+
.containsExactlyInAnyOrder(ClientAuthenticationMethod.CLIENT_SECRET_BASIC, ClientAuthenticationMethod.CLIENT_SECRET_POST);
329+
}
330+
331+
@Test
332+
public void buildWhenConsumerAddsDeprecatedClientAuthenticationMethodsThenNonDeprecatedAreRegistered() {
299333
RegisteredClient registration = RegisteredClient.withId(ID)
300334
.clientId(CLIENT_ID)
301335
.clientSecret(CLIENT_SECRET)
@@ -309,7 +343,7 @@ public void buildWhenClientAuthenticationMethodsConsumerIsProvidedThenConsumerAc
309343
.build();
310344

311345
assertThat(registration.getClientAuthenticationMethods())
312-
.containsExactlyInAnyOrder(ClientAuthenticationMethod.BASIC, ClientAuthenticationMethod.POST);
346+
.containsExactlyInAnyOrder(ClientAuthenticationMethod.CLIENT_SECRET_BASIC, ClientAuthenticationMethod.CLIENT_SECRET_POST);
313347
}
314348

315349
@Test

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/client/TestRegisteredClients.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ public static RegisteredClient.Builder registeredClient() {
3333
.clientSecret("secret")
3434
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
3535
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
36-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
36+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
3737
.redirectUri("https://example.com")
3838
.scope("scope1");
3939
}
@@ -46,8 +46,8 @@ public static RegisteredClient.Builder registeredClient2() {
4646
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
4747
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
4848
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
49-
.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
50-
.clientAuthenticationMethod(ClientAuthenticationMethod.POST)
49+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
50+
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_POST)
5151
.redirectUri("https://example.com")
5252
.scope("scope1")
5353
.scope("scope2");

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProviderTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ public void authenticateWhenValidAccessTokenThenReturnClientRegistration() {
259259
assertThat(registeredClientResult.getClientIdIssuedAt()).isNotNull();
260260
assertThat(registeredClientResult.getClientSecret()).isNotNull();
261261
assertThat(registeredClientResult.getClientName()).isEqualTo(clientRegistration.getClientName());
262-
assertThat(registeredClientResult.getClientAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.BASIC);
262+
assertThat(registeredClientResult.getClientAuthenticationMethods()).containsExactly(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
263263
assertThat(registeredClientResult.getRedirectUris()).containsExactly("https://client.example.com");
264264
assertThat(registeredClientResult.getAuthorizationGrantTypes())
265265
.containsExactlyInAnyOrder(AuthorizationGrantType.AUTHORIZATION_CODE, AuthorizationGrantType.CLIENT_CREDENTIALS);

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/ClientSecretBasicAuthenticationConverterTests.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020 the original author or authors.
2+
* Copyright 2020-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -99,7 +99,7 @@ public void convertWhenAuthorizationHeaderBasicWithValidCredentialsThenReturnCli
9999
OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request);
100100
assertThat(authentication.getPrincipal()).isEqualTo("clientId");
101101
assertThat(authentication.getCredentials()).isEqualTo("secret");
102-
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
102+
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
103103
}
104104

105105
@Test
@@ -109,7 +109,7 @@ public void convertWhenConfidentialClientWithPkceParametersThenAdditionalParamet
109109
OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request);
110110
assertThat(authentication.getPrincipal()).isEqualTo("clientId");
111111
assertThat(authentication.getCredentials()).isEqualTo("secret");
112-
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.BASIC);
112+
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
113113
assertThat(authentication.getAdditionalParameters())
114114
.containsOnly(
115115
entry(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.AUTHORIZATION_CODE.getValue()),

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/ClientSecretPostAuthenticationConverterTests.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020 the original author or authors.
2+
* Copyright 2020-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -86,7 +86,7 @@ public void convertWhenPostWithValidCredentialsThenReturnClientAuthenticationTok
8686
OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request);
8787
assertThat(authentication.getPrincipal()).isEqualTo("client-1");
8888
assertThat(authentication.getCredentials()).isEqualTo("client-secret");
89-
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.POST);
89+
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_POST);
9090
}
9191

9292
@Test
@@ -97,7 +97,7 @@ public void convertWhenConfidentialClientWithPkceParametersThenAdditionalParamet
9797
OAuth2ClientAuthenticationToken authentication = (OAuth2ClientAuthenticationToken) this.converter.convert(request);
9898
assertThat(authentication.getPrincipal()).isEqualTo("client-1");
9999
assertThat(authentication.getCredentials()).isEqualTo("client-secret");
100-
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.POST);
100+
assertThat(authentication.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_POST);
101101
assertThat(authentication.getAdditionalParameters())
102102
.containsOnly(
103103
entry(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.AUTHORIZATION_CODE.getValue()),

0 commit comments

Comments
 (0)