Skip to content

Commit 2dd908d

Browse files
sjohnrsjohnr
committed
Document additional client authenticating methods
Issue gh-11440 Closes gh-14982
1 parent 2598bf8 commit 2dd908d

File tree

2 files changed

+205
-0
lines changed

2 files changed

+205
-0
lines changed

‎docs/modules/ROOT/pages/reactive/oauth2/client/client-authentication.adoc

+99
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,80 @@
11
[[oauth2Client-client-auth-support]]
22
= Client Authentication Support
33

4+
[[oauth2Client-client-credentials-auth]]
5+
== Client Credentials
6+
7+
=== Authenticate using `client_secret_basic`
8+
9+
Client Authentication with HTTP Basic is supported out of the box and no customization is necessary to enable it.
10+
The default implementation is provided by `DefaultOAuth2TokenRequestHeadersConverter`.
11+
12+
Given the following Spring Boot properties for an OAuth 2.0 client registration:
13+
14+
[source,yaml]
15+
----
16+
spring:
17+
security:
18+
oauth2:
19+
client:
20+
registration:
21+
okta:
22+
client-id: client-id
23+
client-secret: client-secret
24+
client-authentication-method: client_secret_basic
25+
authorization-grant-type: authorization_code
26+
...
27+
----
28+
29+
The following example shows how to configure `WebClientReactiveAuthorizationCodeTokenResponseClient` to disable URL encoding of the client credentials:
30+
31+
[tabs]
32+
======
33+
Java::
34+
+
35+
[source,java,role="primary"]
36+
----
37+
DefaultOAuth2TokenRequestHeadersConverter<OAuth2AuthorizationCodeGrantRequest> headersConverter =
38+
new DefaultOAuth2TokenRequestHeadersConverter<>();
39+
headersConverter.setEncodeClientCredentials(false);
40+
41+
WebClientReactiveAuthorizationCodeTokenResponseClient tokenResponseClient =
42+
new WebClientReactiveAuthorizationCodeTokenResponseClient();
43+
tokenResponseClient.setHeadersConverter(headersConverter);
44+
----
45+
46+
Kotlin::
47+
+
48+
[source,kotlin,role="secondary"]
49+
----
50+
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter<OAuth2AuthorizationCodeGrantRequest>()
51+
headersConverter.setEncodeClientCredentials(false)
52+
53+
val tokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
54+
tokenResponseClient.setHeadersConverter(headersConverter)
55+
----
56+
======
57+
58+
=== Authenticate using `client_secret_post`
59+
60+
Client Authentication with client credentials included in the request-body is supported out of the box and no customization is necessary to enable it.
61+
62+
The following Spring Boot properties for an OAuth 2.0 client registration demonstrate the configuration:
63+
64+
[source,yaml]
65+
----
66+
spring:
67+
security:
68+
oauth2:
69+
client:
70+
registration:
71+
okta:
72+
client-id: client-id
73+
client-secret: client-secret
74+
client-authentication-method: client_secret_post
75+
authorization-grant-type: authorization_code
76+
...
77+
----
478

579
[[oauth2Client-jwt-bearer-auth]]
680
== JWT Bearer
@@ -190,3 +264,28 @@ converter.setJwtClientAssertionCustomizer { context ->
190264
}
191265
----
192266
======
267+
268+
[[oauth2Client-public-auth]]
269+
== Public Authentication
270+
271+
Public Client Authentication is supported out of the box and no customization is necessary to enable it.
272+
273+
The following Spring Boot properties for an OAuth 2.0 client registration demonstrate the configuration:
274+
275+
[source,yaml]
276+
----
277+
spring:
278+
security:
279+
oauth2:
280+
client:
281+
registration:
282+
okta:
283+
client-id: client-id
284+
client-authentication-method: none
285+
authorization-grant-type: authorization_code
286+
...
287+
----
288+
289+
[NOTE]
290+
Public Clients are supported using https://tools.ietf.org/html/rfc7636[Proof Key for Code Exchange] (PKCE).
291+
PKCE will automatically be used when `client-authentication-method` is set to "none" (`ClientAuthenticationMethod.NONE`).

‎docs/modules/ROOT/pages/servlet/oauth2/client/client-authentication.adoc

+106
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,87 @@
11
[[oauth2Client-client-auth-support]]
22
= Client Authentication Support
33

4+
[[oauth2Client-client-credentials-auth]]
5+
== Client Credentials
6+
7+
=== Authenticate using `client_secret_basic`
8+
9+
Client Authentication with HTTP Basic is supported out of the box and no customization is necessary to enable it.
10+
The default implementation is provided by `DefaultOAuth2TokenRequestHeadersConverter`.
11+
12+
Given the following Spring Boot properties for an OAuth 2.0 client registration:
13+
14+
[source,yaml]
15+
----
16+
spring:
17+
security:
18+
oauth2:
19+
client:
20+
registration:
21+
okta:
22+
client-id: client-id
23+
client-secret: client-secret
24+
client-authentication-method: client_secret_basic
25+
authorization-grant-type: authorization_code
26+
...
27+
----
28+
29+
The following example shows how to configure `DefaultAuthorizationCodeTokenResponseClient` to disable URL encoding of the client credentials:
30+
31+
[tabs]
32+
======
33+
Java::
34+
+
35+
[source,java,role="primary"]
36+
----
37+
DefaultOAuth2TokenRequestHeadersConverter<OAuth2AuthorizationCodeGrantRequest> headersConverter =
38+
new DefaultOAuth2TokenRequestHeadersConverter<>();
39+
headersConverter.setEncodeClientCredentials(false);
40+
41+
OAuth2AuthorizationCodeGrantRequestEntityConverter requestEntityConverter =
42+
new OAuth2AuthorizationCodeGrantRequestEntityConverter();
43+
requestEntityConverter.setHeadersConverter(headersConverter);
44+
45+
DefaultAuthorizationCodeTokenResponseClient tokenResponseClient =
46+
new DefaultAuthorizationCodeTokenResponseClient();
47+
tokenResponseClient.setRequestEntityConverter(requestEntityConverter);
48+
----
49+
50+
Kotlin::
51+
+
52+
[source,kotlin,role="secondary"]
53+
----
54+
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter<OAuth2AuthorizationCodeGrantRequest>()
55+
headersConverter.setEncodeClientCredentials(false)
56+
57+
val requestEntityConverter = OAuth2AuthorizationCodeGrantRequestEntityConverter()
58+
requestEntityConverter.setHeadersConverter(headersConverter)
59+
60+
val tokenResponseClient = DefaultAuthorizationCodeTokenResponseClient()
61+
tokenResponseClient.setRequestEntityConverter(requestEntityConverter)
62+
----
63+
======
64+
65+
=== Authenticate using `client_secret_post`
66+
67+
Client Authentication with client credentials included in the request-body is supported out of the box and no customization is necessary to enable it.
68+
69+
The following Spring Boot properties for an OAuth 2.0 client registration demonstrate the configuration:
70+
71+
[source,yaml]
72+
----
73+
spring:
74+
security:
75+
oauth2:
76+
client:
77+
registration:
78+
okta:
79+
client-id: client-id
80+
client-secret: client-secret
81+
client-authentication-method: client_secret_post
82+
authorization-grant-type: authorization_code
83+
...
84+
----
485

586
[[oauth2Client-jwt-bearer-auth]]
687
== JWT Bearer
@@ -203,3 +284,28 @@ converter.setJwtClientAssertionCustomizer { context ->
203284
}
204285
----
205286
======
287+
288+
[[oauth2Client-public-auth]]
289+
== Public Authentication
290+
291+
Public Client Authentication is supported out of the box and no customization is necessary to enable it.
292+
293+
The following Spring Boot properties for an OAuth 2.0 client registration demonstrate the configuration:
294+
295+
[source,yaml]
296+
----
297+
spring:
298+
security:
299+
oauth2:
300+
client:
301+
registration:
302+
okta:
303+
client-id: client-id
304+
client-authentication-method: none
305+
authorization-grant-type: authorization_code
306+
...
307+
----
308+
309+
[NOTE]
310+
Public Clients are supported using https://tools.ietf.org/html/rfc7636[Proof Key for Code Exchange] (PKCE).
311+
PKCE will automatically be used when `client-authentication-method` is set to "none" (`ClientAuthenticationMethod.NONE`).

0 commit comments

Comments
 (0)