Add BearerTokenAuthenticationConverter

[thecodinglog]

BearerTokenAuthenticationConverter is introduced to solve the problem of not being able to change AuthenticationDetailsSource.

Closes gh-8840

[jzheaux]

Thanks for the PR, @thecodinglog! I've left some feedback inline.

Also, would you be able to update OAuth2ResourceServerConfigurer to use setAuthenticationConverter instead of BearerTokenResolver?

[benba]

Thanks for this PR @thecodinglog , I needed exactly this to implement a feature that also needs to add additional information into the details.

I've tried to use it on the current Spring Security version while waiting for 5.5.0, and I was wandering if it wouldn't be easier if BearerTokenAuthenticationConverter was an interface that extends AuthenticationConverter and define setBearerTokenResolver and setAuthenticationDetailsSource methods.
The implementation would then be into something like DefaultBearerTokenAuthenticationConverter.

The reason I asked this because today, you are forced to subclass BearerTokenAuthenticationConverter to be able to customize BearerTokenAuthenticationFilter (since the BearerTokenAuthenticationFilter.setAuthenticationConverter takes a BearerTokenAuthenticationConverter), and one may need a completely different implementation.

Another option could be to use a bare AuthenticationConverter and handle the backward compatibility in BearerTokenAuthenticationFilter.setBearerTokenResolver with a cast to BearerTokenAuthenticationConverter if the authenticationConverter is of this type.

[thecodinglog]

Thanks for such a good opinion @benba .

This PR focused on being able to change the AuthenticationDetailsSource in BearerTokenAuthenticationFilter.
Adding a setter to the BearerTokenAuthenticationFilter is easiest way but there was an opinion that it would be better to make the implementation similar to other AuthenticationConverter implementations. I agreed that and I did like that.

I agree that BearerTokenAuthenticationConverter is more flexible if it is an interface, but I disagree to create an interface where the interface's methods are only setters. Because it doesn't clearly explain what the interface does.

If you need an interface for the setter It would be better to use BearerTokenAuthenticationConverter in combination with interfaces such as AuthenticationConverter and BearerTokenResolverReplacable. But this seems too verbose.

As you mentioned, you may need a completely different implementation for BearerTokenAuthenticationConverter.
For this, I don't like it too, but I didn't make it a final class so that it could be inherited.

I'm not sure I understand the last opinion which you mentioned but you mean that do the setBearerTokenResolver of the BearerTokenAuthenticationFilter class as below?

public void setBearerTokenResolver(BearerTokenResolver bearerTokenResolver) {
    if(bearerTokenResolver instanceof BearerTokenAuthenticationConverter)
        this.authenticationConverter = (BearerTokenAuthenticationConverter)bearerTokenResolver;
    else
        this.authenticationConverter.setBearerTokenResolver(bearerTokenResolver);
}

If so, Since BearerTokenResolver and AuthenticationConverter are interfaces that have completely different functions, but I think that it is not intuitive from the user's point of view.
In order to use the above method, I think the users might carefully read the related documentation or see the implementation to get a sense of how to use it.

Thanks again!😃

[jzheaux]

Thanks again, @thecodinglog, and my apologies for the delay in responding. I've left some additional feedback inline.

Also, as a housekeeping item, will you please update the copyright headers in the files in this PR to have an end date of 2021? Thanks!

[jzheaux]

Thanks, @thecodinglog! This is now merged into master via 31f310f.

I also added a polish via b774e91 that simplified a method name and rearranged some of the methods and fields.