Skip to content

Commit a03fe8b

Browse files
wilkinsonawilkinsona
committed
Enable customization of JWK Set URI decoder builders
Closes gh-20750
1 parent 45068c7 commit a03fe8b

File tree

6 files changed

+192
-37
lines changed

6 files changed

+192
-37
lines changed

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/JwkSetUriReactiveJwtDecoderBuilderCustomizer.java

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
* Copyright 2012-2023 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
18+
19+
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder.JwkSetUriReactiveJwtDecoderBuilder;
20+
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
21+
22+
/**
23+
* Callback interface for the customization of the
24+
* {@link JwkSetUriReactiveJwtDecoderBuilder} used to create the auto-configured
25+
* {@link ReactiveJwtDecoder} for a JWK set URI that has been configured directly or
26+
* obtained through an issuer URI.
27+
*
28+
* @author Andy Wilkinson
29+
* @since 3.1.0
30+
*/
31+
@FunctionalInterface
32+
public interface JwkSetUriReactiveJwtDecoderBuilderCustomizer {
33+
34+
/**
35+
* Customize the given {@code builder}.
36+
* @param builder the {@code builder} to customize
37+
*/
38+
void customize(JwkSetUriReactiveJwtDecoderBuilder builder);
39+
40+
}

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerJwkConfiguration.java

+13-8
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.Set;
2727
import java.util.function.Supplier;
2828

29+
import org.springframework.beans.factory.ObjectProvider;
2930
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
3031
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
3132
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -45,8 +46,8 @@
4546
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
4647
import org.springframework.security.oauth2.jwt.JwtValidators;
4748
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder;
49+
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder.JwkSetUriReactiveJwtDecoderBuilder;
4850
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
49-
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoders;
5051
import org.springframework.security.oauth2.jwt.SupplierReactiveJwtDecoder;
5152
import org.springframework.security.web.server.SecurityWebFilterChain;
5253
import org.springframework.util.CollectionUtils;
@@ -77,11 +78,12 @@ static class JwtConfiguration {
7778

7879
@Bean
7980
@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
80-
ReactiveJwtDecoder jwtDecoder() {
81-
NimbusReactiveJwtDecoder nimbusReactiveJwtDecoder = NimbusReactiveJwtDecoder
81+
ReactiveJwtDecoder jwtDecoder(ObjectProvider<JwkSetUriReactiveJwtDecoderBuilderCustomizer> customizers) {
82+
JwkSetUriReactiveJwtDecoderBuilder builder = NimbusReactiveJwtDecoder
8283
.withJwkSetUri(this.properties.getJwkSetUri())
83-
.jwsAlgorithms(this::jwsAlgorithms)
84-
.build();
84+
.jwsAlgorithms(this::jwsAlgorithms);
85+
customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
86+
NimbusReactiveJwtDecoder nimbusReactiveJwtDecoder = builder.build();
8587
String issuerUri = this.properties.getIssuerUri();
8688
Supplier<OAuth2TokenValidator<Jwt>> defaultValidator = (issuerUri != null)
8789
? () -> JwtValidators.createDefaultWithIssuer(issuerUri) : JwtValidators::createDefault;
@@ -138,10 +140,13 @@ private String exactlyOneAlgorithm() {
138140

139141
@Bean
140142
@Conditional(IssuerUriCondition.class)
141-
SupplierReactiveJwtDecoder jwtDecoderByIssuerUri() {
143+
SupplierReactiveJwtDecoder jwtDecoderByIssuerUri(
144+
ObjectProvider<JwkSetUriReactiveJwtDecoderBuilderCustomizer> customizers) {
142145
return new SupplierReactiveJwtDecoder(() -> {
143-
NimbusReactiveJwtDecoder jwtDecoder = (NimbusReactiveJwtDecoder) ReactiveJwtDecoders
144-
.fromIssuerLocation(this.properties.getIssuerUri());
146+
JwkSetUriReactiveJwtDecoderBuilder builder = NimbusReactiveJwtDecoder
147+
.withIssuerLocation(this.properties.getIssuerUri());
148+
customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
149+
NimbusReactiveJwtDecoder jwtDecoder = builder.build();
145150
jwtDecoder.setJwtValidator(
146151
getValidators(() -> JwtValidators.createDefaultWithIssuer(this.properties.getIssuerUri())));
147152
return jwtDecoder;

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/JwkSetUriJwtDecoderBuilderCustomizer.java

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* Copyright 2012-2023 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
18+
19+
import org.springframework.security.oauth2.jwt.JwtDecoder;
20+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder;
21+
22+
/**
23+
* Callback interface for the customization of the {@link JwkSetUriJwtDecoderBuilder} used
24+
* to create the auto-configured {@link JwtDecoder} for a JWK set URI that has been
25+
* configured directly or obtained through an issuer URI.
26+
*
27+
* @author Andy Wilkinson
28+
* @since 3.1.0
29+
*/
30+
@FunctionalInterface
31+
public interface JwkSetUriJwtDecoderBuilderCustomizer {
32+
33+
/**
34+
* Customize the given {@code builder}.
35+
* @param builder the {@code builder} to customize
36+
*/
37+
void customize(JwkSetUriJwtDecoderBuilder builder);
38+
39+
}

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/servlet/OAuth2ResourceServerJwtConfiguration.java

+11-7
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.Set;
2727
import java.util.function.Supplier;
2828

29+
import org.springframework.beans.factory.ObjectProvider;
2930
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
3031
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
3132
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -44,9 +45,9 @@
4445
import org.springframework.security.oauth2.jwt.JwtClaimNames;
4546
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
4647
import org.springframework.security.oauth2.jwt.JwtDecoder;
47-
import org.springframework.security.oauth2.jwt.JwtDecoders;
4848
import org.springframework.security.oauth2.jwt.JwtValidators;
4949
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
50+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder;
5051
import org.springframework.security.oauth2.jwt.SupplierJwtDecoder;
5152
import org.springframework.security.web.SecurityFilterChain;
5253
import org.springframework.util.CollectionUtils;
@@ -78,10 +79,11 @@ static class JwtDecoderConfiguration {
7879

7980
@Bean
8081
@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
81-
JwtDecoder jwtDecoderByJwkKeySetUri() {
82-
NimbusJwtDecoder nimbusJwtDecoder = NimbusJwtDecoder.withJwkSetUri(this.properties.getJwkSetUri())
83-
.jwsAlgorithms(this::jwsAlgorithms)
84-
.build();
82+
JwtDecoder jwtDecoderByJwkKeySetUri(ObjectProvider<JwkSetUriJwtDecoderBuilderCustomizer> customizers) {
83+
JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withJwkSetUri(this.properties.getJwkSetUri())
84+
.jwsAlgorithms(this::jwsAlgorithms);
85+
customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
86+
NimbusJwtDecoder nimbusJwtDecoder = builder.build();
8587
String issuerUri = this.properties.getIssuerUri();
8688
Supplier<OAuth2TokenValidator<Jwt>> defaultValidator = (issuerUri != null)
8789
? () -> JwtValidators.createDefaultWithIssuer(issuerUri) : JwtValidators::createDefault;
@@ -138,10 +140,12 @@ private String exactlyOneAlgorithm() {
138140

139141
@Bean
140142
@Conditional(IssuerUriCondition.class)
141-
SupplierJwtDecoder jwtDecoderByIssuerUri() {
143+
SupplierJwtDecoder jwtDecoderByIssuerUri(ObjectProvider<JwkSetUriJwtDecoderBuilderCustomizer> customizers) {
142144
return new SupplierJwtDecoder(() -> {
143145
String issuerUri = this.properties.getIssuerUri();
144-
NimbusJwtDecoder jwtDecoder = JwtDecoders.fromIssuerLocation(issuerUri);
146+
JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withIssuerLocation(issuerUri);
147+
customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
148+
NimbusJwtDecoder jwtDecoder = builder.build();
145149
jwtDecoder.setJwtValidator(getValidators(() -> JwtValidators.createDefaultWithIssuer(issuerUri)));
146150
return jwtDecoder;
147151
});

‎spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/resource/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java

+59-22
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
import org.assertj.core.api.InstanceOfAssertFactories;
3636
import org.junit.jupiter.api.AfterEach;
3737
import org.junit.jupiter.api.Test;
38+
import org.mockito.InOrder;
3839
import reactor.core.publisher.Mono;
3940

4041
import org.springframework.boot.autoconfigure.AutoConfigurations;
@@ -43,6 +44,7 @@
4344
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
4445
import org.springframework.context.annotation.Bean;
4546
import org.springframework.context.annotation.Configuration;
47+
import org.springframework.core.annotation.Order;
4648
import org.springframework.http.HttpHeaders;
4749
import org.springframework.http.HttpStatus;
4850
import org.springframework.http.MediaType;
@@ -72,6 +74,8 @@
7274
import org.springframework.web.server.WebFilter;
7375

7476
import static org.assertj.core.api.Assertions.assertThat;
77+
import static org.mockito.ArgumentMatchers.any;
78+
import static org.mockito.Mockito.inOrder;
7579
import static org.mockito.Mockito.mock;
7680
import static org.springframework.security.config.Customizer.withDefaults;
7781

@@ -92,7 +96,7 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests {
9296

9397
private MockWebServer server;
9498

95-
private static final Duration TIMEOUT = Duration.ofSeconds(5);
99+
private static final Duration TIMEOUT = Duration.ofSeconds(5000000);
96100

97101
private static final String JWK_SET = "{\"keys\":[{\"kty\":\"RSA\",\"e\":\"AQAB\",\"use\":\"sig\","
98102
+ "\"kid\":\"one\",\"n\":\"oXJ8OyOv_eRnce4akdanR4KYRfnC2zLV4uYNQpcFn6oHL0dj7D6kxQmsXoYgJV8ZVDn71KGm"
@@ -127,9 +131,21 @@ void autoConfigurationUsingJwkSetUriShouldConfigureResourceServerUsingSingleJwsA
127131
assertThat(nimbusReactiveJwtDecoder).extracting("jwtProcessor.arg$1.signatureAlgorithms")
128132
.asInstanceOf(InstanceOfAssertFactories.collection(SignatureAlgorithm.class))
129133
.containsExactlyInAnyOrder(SignatureAlgorithm.RS512);
134+
assertJwkSetUriReactiveJwtDecoderBuilderCustomization(context);
130135
});
131136
}
132137

138+
private void assertJwkSetUriReactiveJwtDecoderBuilderCustomization(
139+
AssertableReactiveWebApplicationContext context) {
140+
JwkSetUriReactiveJwtDecoderBuilderCustomizer customizer = context.getBean("decoderBuilderCustomizer",
141+
JwkSetUriReactiveJwtDecoderBuilderCustomizer.class);
142+
JwkSetUriReactiveJwtDecoderBuilderCustomizer anotherCustomizer = context
143+
.getBean("anotherDecoderBuilderCustomizer", JwkSetUriReactiveJwtDecoderBuilderCustomizer.class);
144+
InOrder inOrder = inOrder(customizer, anotherCustomizer);
145+
inOrder.verify(customizer).customize(any());
146+
inOrder.verify(anotherCustomizer).customize(any());
147+
}
148+
133149
@Test
134150
void autoConfigurationUsingJwkSetUriShouldConfigureResourceServerUsingMultipleJwsAlgorithms() {
135151
this.contextRunner
@@ -141,6 +157,7 @@ void autoConfigurationUsingJwkSetUriShouldConfigureResourceServerUsingMultipleJw
141157
.asInstanceOf(InstanceOfAssertFactories.collection(SignatureAlgorithm.class))
142158
.containsExactlyInAnyOrder(SignatureAlgorithm.RS256, SignatureAlgorithm.RS384,
143159
SignatureAlgorithm.RS512);
160+
assertJwkSetUriReactiveJwtDecoderBuilderCustomization(context);
144161
});
145162
}
146163

@@ -172,7 +189,6 @@ void autoConfigurationUsingPublicKeyValueWithMultipleJwsAlgorithmsShouldFail() {
172189
}
173190

174191
@Test
175-
@SuppressWarnings("unchecked")
176192
void autoConfigurationShouldConfigureResourceServerUsingOidcIssuerUri() throws IOException {
177193
this.server = new MockWebServer();
178194
this.server.start();
@@ -187,18 +203,32 @@ void autoConfigurationShouldConfigureResourceServerUsingOidcIssuerUri() throws I
187203
assertThat(context).hasSingleBean(SupplierReactiveJwtDecoder.class);
188204
assertFilterConfiguredWithJwtAuthenticationManager(context);
189205
assertThat(context.containsBean("jwtDecoderByIssuerUri")).isTrue();
190-
SupplierReactiveJwtDecoder supplierReactiveJwtDecoder = context
191-
.getBean(SupplierReactiveJwtDecoder.class);
192-
Mono<ReactiveJwtDecoder> reactiveJwtDecoderSupplier = (Mono<ReactiveJwtDecoder>) ReflectionTestUtils
193-
.getField(supplierReactiveJwtDecoder, "jwtDecoderMono");
194-
reactiveJwtDecoderSupplier.block(TIMEOUT);
206+
// Trigger calls to the issuer by decoding a token
207+
decodeJwt(context);
208+
assertJwkSetUriReactiveJwtDecoderBuilderCustomization(context);
195209
});
196210
// The last request is to the JWK Set endpoint to look up the algorithm
197-
assertThat(this.server.getRequestCount()).isOne();
211+
assertThat(this.server.getRequestCount()).isEqualTo(2);
198212
}
199213

200-
@Test
201214
@SuppressWarnings("unchecked")
215+
private void decodeJwt(AssertableReactiveWebApplicationContext context) {
216+
SupplierReactiveJwtDecoder supplierReactiveJwtDecoder = context.getBean(SupplierReactiveJwtDecoder.class);
217+
Mono<ReactiveJwtDecoder> reactiveJwtDecoderSupplier = (Mono<ReactiveJwtDecoder>) ReflectionTestUtils
218+
.getField(supplierReactiveJwtDecoder, "jwtDecoderMono");
219+
try {
220+
reactiveJwtDecoderSupplier.flatMap((decoder) -> decoder.decode("eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9."
221+
+ "eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0."
222+
+ "NHVaYe26MbtOYhSKkoKYdFVomg4i8ZJd8_-RU8VNbftc4TSMb4bXP3l3YlNWACwyXPGffz5aXHc6lty1Y2t4SWRqGteragsVdZufDn5BlnJl9pdR_kdVFUsra2rWKEofkZeIC4yWytE58sMIihvo9H1ScmmVwBcQP6XETqYd0aSHp1gOa9RdUPDvoXQ5oqygTqVtxaDr6wUFKrKItgBMzWIdNZ6y7O9E0DhEPTbE9rfBo6KTFsHAZnMg4k68CDp2woYIaXbmYTWcvbzIuHO7_37GT79XdIwkm95QJ7hYC9RiwrV7mesbY4PAahERJawntho0my942XheVLmGwLMBkQ"))
223+
.block(TIMEOUT);
224+
}
225+
catch (Exception ex) {
226+
// This fails, but it's enough to check that the expected HTTP calls
227+
// are made
228+
}
229+
}
230+
231+
@Test
202232
void autoConfigurationShouldConfigureResourceServerUsingOidcRfc8414IssuerUri() throws Exception {
203233
this.server = new MockWebServer();
204234
this.server.start();
@@ -212,18 +242,15 @@ void autoConfigurationShouldConfigureResourceServerUsingOidcRfc8414IssuerUri() t
212242
assertThat(context).hasSingleBean(SupplierReactiveJwtDecoder.class);
213243
assertFilterConfiguredWithJwtAuthenticationManager(context);
214244
assertThat(context.containsBean("jwtDecoderByIssuerUri")).isTrue();
215-
SupplierReactiveJwtDecoder supplierReactiveJwtDecoder = context
216-
.getBean(SupplierReactiveJwtDecoder.class);
217-
Mono<ReactiveJwtDecoder> reactiveJwtDecoderSupplier = (Mono<ReactiveJwtDecoder>) ReflectionTestUtils
218-
.getField(supplierReactiveJwtDecoder, "jwtDecoderMono");
219-
reactiveJwtDecoderSupplier.block(TIMEOUT);
245+
// Trigger calls to the issuer by decoding a token
246+
decodeJwt(context);
247+
// assertJwkSetUriReactiveJwtDecoderBuilderCustomization(context);
220248
});
221249
// The last request is to the JWK Set endpoint to look up the algorithm
222-
assertThat(this.server.getRequestCount()).isEqualTo(2);
250+
assertThat(this.server.getRequestCount()).isEqualTo(3);
223251
}
224252

225253
@Test
226-
@SuppressWarnings("unchecked")
227254
void autoConfigurationShouldConfigureResourceServerUsingOAuthIssuerUri() throws Exception {
228255
this.server = new MockWebServer();
229256
this.server.start();
@@ -237,14 +264,12 @@ void autoConfigurationShouldConfigureResourceServerUsingOAuthIssuerUri() throws
237264
assertThat(context).hasSingleBean(SupplierReactiveJwtDecoder.class);
238265
assertFilterConfiguredWithJwtAuthenticationManager(context);
239266
assertThat(context.containsBean("jwtDecoderByIssuerUri")).isTrue();
240-
SupplierReactiveJwtDecoder supplierReactiveJwtDecoder = context
241-
.getBean(SupplierReactiveJwtDecoder.class);
242-
Mono<ReactiveJwtDecoder> reactiveJwtDecoderSupplier = (Mono<ReactiveJwtDecoder>) ReflectionTestUtils
243-
.getField(supplierReactiveJwtDecoder, "jwtDecoderMono");
244-
reactiveJwtDecoderSupplier.block(TIMEOUT);
267+
// Trigger calls to the issuer by decoding a token
268+
decodeJwt(context);
269+
assertJwkSetUriReactiveJwtDecoderBuilderCustomization(context);
245270
});
246271
// The last request is to the JWK Set endpoint to look up the algorithm
247-
assertThat(this.server.getRequestCount()).isEqualTo(3);
272+
assertThat(this.server.getRequestCount()).isEqualTo(4);
248273
}
249274

250275
@Test
@@ -666,6 +691,18 @@ MapReactiveUserDetailsService userDetailsService() {
666691
return mock(MapReactiveUserDetailsService.class);
667692
}
668693

694+
@Bean
695+
@Order(1)
696+
JwkSetUriReactiveJwtDecoderBuilderCustomizer decoderBuilderCustomizer() {
697+
return mock(JwkSetUriReactiveJwtDecoderBuilderCustomizer.class);
698+
}
699+
700+
@Bean
701+
@Order(2)
702+
JwkSetUriReactiveJwtDecoderBuilderCustomizer anotherDecoderBuilderCustomizer() {
703+
return mock(JwkSetUriReactiveJwtDecoderBuilderCustomizer.class);
704+
}
705+
669706
}
670707

671708
@Configuration(proxyBeanMethods = false)

0 commit comments

Comments
 (0)