Skip to content

Commit 9b24f66

Browse files
Steve Riesenbergsjohnr
Steve Riesenberg
authored and
sjohnr
committed
Implement reactive support for JWT as an Authorization Grant
Closes gh-10147
1 parent 02b2fcc commit 9b24f66

File tree

5 files changed

+853
-0
lines changed

5 files changed

+853
-0
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JwtBearerReactiveOAuth2AuthorizedClientProvider.java

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
/*
2+
* Copyright 2002-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.client;
18+
19+
import java.time.Clock;
20+
import java.time.Duration;
21+
import java.time.Instant;
22+
23+
import reactor.core.publisher.Mono;
24+
25+
import org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequest;
26+
import org.springframework.security.oauth2.client.endpoint.ReactiveOAuth2AccessTokenResponseClient;
27+
import org.springframework.security.oauth2.client.endpoint.WebClientReactiveJwtBearerTokenResponseClient;
28+
import org.springframework.security.oauth2.client.registration.ClientRegistration;
29+
import org.springframework.security.oauth2.core.AuthorizationGrantType;
30+
import org.springframework.security.oauth2.core.OAuth2AuthorizationException;
31+
import org.springframework.security.oauth2.core.OAuth2Token;
32+
import org.springframework.security.oauth2.jwt.Jwt;
33+
import org.springframework.util.Assert;
34+
35+
/**
36+
* An implementation of an {@link ReactiveOAuth2AuthorizedClientProvider} for the
37+
* {@link AuthorizationGrantType#JWT_BEARER jwt-bearer} grant.
38+
*
39+
* @author Steve Riesenberg
40+
* @since 5.6
41+
* @see ReactiveOAuth2AuthorizedClientProvider
42+
* @see WebClientReactiveJwtBearerTokenResponseClient
43+
*/
44+
public final class JwtBearerReactiveOAuth2AuthorizedClientProvider implements ReactiveOAuth2AuthorizedClientProvider {
45+
46+
private ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient = new WebClientReactiveJwtBearerTokenResponseClient();
47+
48+
private Duration clockSkew = Duration.ofSeconds(60);
49+
50+
private Clock clock = Clock.systemUTC();
51+
52+
/**
53+
* Attempt to authorize (or re-authorize) the
54+
* {@link OAuth2AuthorizationContext#getClientRegistration() client} in the provided
55+
* {@code context}. Returns an empty {@code Mono} if authorization (or
56+
* re-authorization) is not supported, e.g. the client's
57+
* {@link ClientRegistration#getAuthorizationGrantType() authorization grant type} is
58+
* not {@link AuthorizationGrantType#JWT_BEARER jwt-bearer} OR the
59+
* {@link OAuth2AuthorizedClient#getAccessToken() access token} is not expired.
60+
* @param context the context that holds authorization-specific state for the client
61+
* @return the {@link OAuth2AuthorizedClient} or an empty {@code Mono} if
62+
* authorization is not supported
63+
*/
64+
@Override
65+
public Mono<OAuth2AuthorizedClient> authorize(OAuth2AuthorizationContext context) {
66+
Assert.notNull(context, "context cannot be null");
67+
ClientRegistration clientRegistration = context.getClientRegistration();
68+
if (!AuthorizationGrantType.JWT_BEARER.equals(clientRegistration.getAuthorizationGrantType())) {
69+
return Mono.empty();
70+
}
71+
OAuth2AuthorizedClient authorizedClient = context.getAuthorizedClient();
72+
if (authorizedClient != null && !hasTokenExpired(authorizedClient.getAccessToken())) {
73+
// If client is already authorized but access token is NOT expired than no
74+
// need for re-authorization
75+
return Mono.empty();
76+
}
77+
if (!(context.getPrincipal().getPrincipal() instanceof Jwt)) {
78+
return Mono.empty();
79+
}
80+
Jwt jwt = (Jwt) context.getPrincipal().getPrincipal();
81+
// As per spec, in section 4.1 Using Assertions as Authorization Grants
82+
// https://tools.ietf.org/html/rfc7521#section-4.1
83+
//
84+
// An assertion used in this context is generally a short-lived
85+
// representation of the authorization grant, and authorization servers
86+
// SHOULD NOT issue access tokens with a lifetime that exceeds the
87+
// validity period of the assertion by a significant period. In
88+
// practice, that will usually mean that refresh tokens are not issued
89+
// in response to assertion grant requests, and access tokens will be
90+
// issued with a reasonably short lifetime. Clients can refresh an
91+
// expired access token by requesting a new one using the same
92+
// assertion, if it is still valid, or with a new assertion.
93+
return Mono.just(new JwtBearerGrantRequest(clientRegistration, jwt))
94+
.flatMap(this.accessTokenResponseClient::getTokenResponse)
95+
.onErrorMap(OAuth2AuthorizationException.class,
96+
(ex) -> new ClientAuthorizationException(ex.getError(), clientRegistration.getRegistrationId(),
97+
ex))
98+
.map((tokenResponse) -> new OAuth2AuthorizedClient(clientRegistration, context.getPrincipal().getName(),
99+
tokenResponse.getAccessToken()));
100+
}
101+
102+
private boolean hasTokenExpired(OAuth2Token token) {
103+
return this.clock.instant().isAfter(token.getExpiresAt().minus(this.clockSkew));
104+
}
105+
106+
/**
107+
* Sets the client used when requesting an access token credential at the Token
108+
* Endpoint for the {@code jwt-bearer} grant.
109+
* @param accessTokenResponseClient the client used when requesting an access token
110+
* credential at the Token Endpoint for the {@code jwt-bearer} grant
111+
*/
112+
public void setAccessTokenResponseClient(
113+
ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient) {
114+
Assert.notNull(accessTokenResponseClient, "accessTokenResponseClient cannot be null");
115+
this.accessTokenResponseClient = accessTokenResponseClient;
116+
}
117+
118+
/**
119+
* Sets the maximum acceptable clock skew, which is used when checking the
120+
* {@link OAuth2AuthorizedClient#getAccessToken() access token} expiry. The default is
121+
* 60 seconds.
122+
*
123+
* <p>
124+
* An access token is considered expired if
125+
* {@code OAuth2AccessToken#getExpiresAt() - clockSkew} is before the current time
126+
* {@code clock#instant()}.
127+
* @param clockSkew the maximum acceptable clock skew
128+
*/
129+
public void setClockSkew(Duration clockSkew) {
130+
Assert.notNull(clockSkew, "clockSkew cannot be null");
131+
Assert.isTrue(clockSkew.getSeconds() >= 0, "clockSkew must be >= 0");
132+
this.clockSkew = clockSkew;
133+
}
134+
135+
/**
136+
* Sets the {@link Clock} used in {@link Instant#now(Clock)} when checking the access
137+
* token expiry.
138+
* @param clock the clock
139+
*/
140+
public void setClock(Clock clock) {
141+
Assert.notNull(clock, "clock cannot be null");
142+
this.clock = clock;
143+
}
144+
145+
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveJwtBearerTokenResponseClient.java

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/*
2+
* Copyright 2002-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.client.endpoint;
18+
19+
import java.util.Set;
20+
21+
import org.springframework.security.oauth2.client.registration.ClientRegistration;
22+
import org.springframework.security.oauth2.core.AuthorizationGrantType;
23+
import org.springframework.security.oauth2.core.OAuth2AccessToken;
24+
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
25+
import org.springframework.web.reactive.function.BodyInserters;
26+
import org.springframework.web.reactive.function.client.WebClient;
27+
28+
/**
29+
* The default implementation of an {@link ReactiveOAuth2AccessTokenResponseClient} for
30+
* the {@link AuthorizationGrantType#JWT_BEARER jwt-bearer} grant. This implementation
31+
* uses {@link WebClient} when requesting an access token credential at the Authorization
32+
* Server's Token Endpoint.
33+
*
34+
* @author Steve Riesenberg
35+
* @since 5.6
36+
* @see ReactiveOAuth2AccessTokenResponseClient
37+
* @see JwtBearerGrantRequest
38+
* @see OAuth2AccessToken
39+
* @see <a target="_blank" href="https://tools.ietf.org/html/rfc7523#section-2.1">Section
40+
* 2.1 Using JWTs as Authorization Grants</a>
41+
* @see <a target="_blank" href="https://tools.ietf.org/html/rfc7521#section-4.1">Section
42+
* 4.1 Using Assertions as Authorization Grants</a>
43+
*/
44+
public final class WebClientReactiveJwtBearerTokenResponseClient
45+
extends AbstractWebClientReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> {
46+
47+
@Override
48+
ClientRegistration clientRegistration(JwtBearerGrantRequest grantRequest) {
49+
return grantRequest.getClientRegistration();
50+
}
51+
52+
@Override
53+
Set<String> scopes(JwtBearerGrantRequest grantRequest) {
54+
return grantRequest.getClientRegistration().getScopes();
55+
}
56+
57+
@Override
58+
BodyInserters.FormInserter<String> populateTokenRequestBody(JwtBearerGrantRequest grantRequest,
59+
BodyInserters.FormInserter<String> body) {
60+
return super.populateTokenRequestBody(grantRequest, body).with(OAuth2ParameterNames.ASSERTION,
61+
grantRequest.getJwt().getTokenValue());
62+
}
63+
64+
}

0 commit comments

Comments
 (0)