Implement Authorization Model / Service

[jgrandja]

An authorization server needs to maintain existing authorizations between a client and resource owner. For example, when a resource owner grants access to a client (to access its protected resources), the authorization server must persist certain data in order to validate the authorization grant flow until it completes.

For example, during an authorization_code grant flow, the authorization server must persist the following data:

• Certain Authorization Request parameters - OAuth2AuthorizationRequest
• The identifier of the client - client_id
• The identifier of the resource owner - current Authentication.getName()
• The authorization code parameter
• The granted access token - OAuth2AccessToken

The initial implementation should provide an in-memory implementation of OAuth2AuthorizationService, similar to InMemoryOAuth2AuthorizedClientService in the spring-security-oauth2-client module.

Implementation Requirements

• InMemoryOAuth2AuthorizationService should store in a Map
• OAuth2Authorization should be immutable
• OAuth2Authorization.attributes should be used for storing data that is specific to an authorization grant, eg. authorization code parameter, OAuth2AuthorizationRequest, etc.
• javadoc class and public methods
• Unit tests

Specification References

4.1. Authorization Code Grant

[krisztian-toth]

Hi @jgrandja, I would be happy to work on this issue.

I have a question though. How would we derive a org.springframework.security.oauth2.server.authorization.TokenType from an org.springframework.security.oauth2.server.authorization.OAuth2Authorization object? Shouldn't the TokenType be a field in OAuth2Authorization? Or do we have to examine the OAuth2Authorization object to find out the type of the token?

[jgrandja]

Thank you @watsta. The issue is yours.

Or do we have to examine the OAuth2Authorization object to find out the type of the token?

Yes, this is correct. The OAuth2AccessToken is a field in OAuth2Authorization and the authorization_code should be in OAuth2Authorization.attributes (see #66)