Added token endpoint implementation

[kratostaine]

Fixes #67

Implementation Requirements

• the Filter should process requests for the (default) path /oauth2/token
• authorizationGrantConverter should convert a valid authorization_code Access Token Request to OAuth2AuthorizationCodeAuthenticationToken
• the OAuth2AuthorizationCodeAuthenticationToken should be passed to the AuthenticationManager
• the AuthenticationManager should be composed of OAuth2AuthorizationCodeAuthenticationProvider
• OAuth2AccessTokenAuthenticationToken should be returned from AuthenticationManager
• the OAuth2AccessToken should be updated in the in-flight OAuth2Authorization
• failure scenarios
• javadoc class and public methods
• Unit tests

[kratostaine]

@jgrandja Have added the initial changes for early feedback. Tests, javadoc to follow. Also need your help to understand the required failure scenarios to be handled here so that I don't add unnecessary checks and failure handling.

[jgrandja]

@kratostaine Please review 4.1.3. Access Token Request to understand all the validations that need to be applied. At minimum, you will need to validate the REQUIRED parameters. However, some of the parameter values will be validated by the OAuth2AuthorizationCodeAuthenticationProvider #68, eg. code

If you are still unsure on what to validate, please send me the reference in the spec and I could let you know if it should be performed in OAuth2TokenEndpointFilter or OAuth2AuthorizationCodeAuthenticationProvider.

[kratostaine]

  grant_type
         REQUIRED.  Value MUST be set to "authorization_code".

   code
         REQUIRED.  The authorization code received from the
         authorization server.

   redirect_uri
         REQUIRED, if the "redirect_uri" parameter was included in the
         authorization request as described in Section 4.1.1, and their
         values MUST be identical.

   client_id
         REQUIRED, if the client is not authenticating with the
         authorization server as described in Section 3.2.1.

@jgrandja the above 4 are the reqd parameters as per the spec. I have done a validation on grant_type already. I also need to do a non-nullable string validation on code, redirect_uri and client_id in the OAuth2TokenEndpointFilter right? Also, how do I validate here the redirect_uri to have value identical to the one as part of the authorization request?

[jgrandja]

@kratostaine

I also need to do a non-nullable string validation on code, redirect_uri and client_id in the OAuth2TokenEndpointFilter right?

Yes for code and redirect_uri. The (confidential) client is required to authenticate in the authorization_code flow, so the expectation is that OAuth2ClientAuthenticationToken #72 is available in the SecurityContext - no need to validate client_id.

how do I validate here the redirect_uri to have value identical to the one as part of the authorization request?

The OAuth2AuthorizationCodeAuthenticationProvider #68 is responsible for this validation.

[kratostaine]

Tests to follow. @jgrandja Please review this so that if there are any changes required, I won't have to rework on the tests.

[kratostaine]

@jgrandja Also regarding AuthenticationManager implementation, I have created a custom class implementing it as OAuth2ClientAuthenticationManager. Is that fine or should I be using the AuthenticationManagerBuilder and set the auth provider with its method authenticationProvider(AuthenticationProvider authenticationProvider) or should I be using ProviderManager?

[jgrandja]

Thanks for the updates @kratostaine. Please see review comments.

Also, please add tests before next review. I typically do not review until tests are written. Writing tests should demonstrate if the implementation is correct or if gaps are missing.

[kratostaine]

@jgrandja could you please help with reviewing this?

[jgrandja]

Thank you for all the updates @kratostaine!

Overall, the implementation looked good and complied to spec for the most part.

I did add a polish commit in order to get this merged, as I'm hoping to complete the first iteration of authorization_code grant later this week. I added some missing validation checks and re-organized some of the code.

Please take a look at the changes applied in the polish commit and let me know if you have any questions.

Thank you again and I look forward to another contribution 👍