Skip to content

Commit 82efcdd

Browse files
jgrandjajgrandja
committed
Merge branch 0.4.x into main
The following commits are merged using the default merge strategy. d669a6b Improve customizing OIDC UserInfo endpoint 286ecad Polish spring-projectsgh-929 ad58264 Improve customizing OIDC Client Registration endpoint bb91d54 Polish spring-projectsgh-946 92669d0 Polish spring-projectsgh-929 18236f5 Fix URL encoding for authorization request state parameter cdcc5ad Polish spring-projectsgh-920 d148d8d Add OidcClientRegistrationAuthenticationProvider.setRegisteredClientConverter()
2 parents c81a932 + d148d8d commit 82efcdd

16 files changed

+1075
-130
lines changed

‎docs/src/docs/asciidoc/protocol-endpoints.adoc

+41-7
Original file line numberDiff line numberDiff line change
@@ -269,9 +269,9 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
269269
== OpenID Connect 1.0 UserInfo Endpoint
270270

271271
`OidcUserInfoEndpointConfigurer` provides the ability to customize the https://openid.net/specs/openid-connect-core-1_0.html#UserInfo[OpenID Connect 1.0 UserInfo endpoint].
272-
It defines extension points that let you customize the https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse[UserInfo response].
272+
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest[UserInfo requests].
273273

274-
`OidcUserInfoEndpointConfigurer` provides the following configuration option:
274+
`OidcUserInfoEndpointConfigurer` provides the following configuration options:
275275

276276
[source,java]
277277
----
@@ -285,21 +285,37 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
285285
.oidc(oidc ->
286286
oidc
287287
.userInfoEndpoint(userInfoEndpoint ->
288-
userInfoEndpoint.userInfoMapper(userInfoMapper) <1>
288+
userInfoEndpoint
289+
.userInfoRequestConverter(userInfoRequestConverter) <1>
290+
.userInfoRequestConverters(userInfoRequestConvertersConsumer) <2>
291+
.authenticationProvider(authenticationProvider) <3>
292+
.authenticationProviders(authenticationProvidersConsumer) <4>
293+
.userInfoResponseHandler(userInfoResponseHandler) <5>
294+
.errorResponseHandler(errorResponseHandler) <6>
295+
.userInfoMapper(userInfoMapper) <7>
289296
)
290297
);
291298
292299
return http.build();
293300
}
294301
----
295-
<1> `userInfoMapper()`: The `Function` used to extract claims from `OidcUserInfoAuthenticationContext` to an instance of `OidcUserInfo`.
302+
<1> `userInfoRequestConverter()`: Adds an `AuthenticationConverter` (_pre-processor_) used when attempting to extract an https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest[UserInfo request] from `HttpServletRequest` to an instance of `OidcUserInfoAuthenticationToken`.
303+
<2> `userInfoRequestConverters()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationConverter``'s allowing the ability to add, remove, or customize a specific `AuthenticationConverter`.
304+
<3> `authenticationProvider()`: Adds an `AuthenticationProvider` (_main processor_) used for authenticating the `OidcUserInfoAuthenticationToken`.
305+
<4> `authenticationProviders()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationProvider``'s allowing the ability to add, remove, or customize a specific `AuthenticationProvider`.
306+
<5> `userInfoResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OidcUserInfoAuthenticationToken` and returning the https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse[UserInfo response].
307+
<6> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://openid.net/specs/openid-connect-core-1_0.html#UserInfoError[UserInfo Error response].
308+
<7> `userInfoMapper()`: The `Function` used to extract claims from `OidcUserInfoAuthenticationContext` to an instance of `OidcUserInfo`.
296309

297310
`OidcUserInfoEndpointConfigurer` configures the `OidcUserInfoEndpointFilter` and registers it with the OAuth2 authorization server `SecurityFilterChain` `@Bean`.
298311
`OidcUserInfoEndpointFilter` is the `Filter` that processes https://openid.net/specs/openid-connect-core-1_0.html#UserInfoRequest[UserInfo requests] and returns the https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse[OidcUserInfo response].
299312

300313
`OidcUserInfoEndpointFilter` is configured with the following defaults:
301314

315+
* `*AuthenticationConverter*` -- An internal implementation that obtains the `Authentication` from the `SecurityContext` and creates an `OidcUserInfoAuthenticationToken` with the principal.
302316
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OidcUserInfoAuthenticationProvider`, which is associated with an internal implementation of `userInfoMapper` that extracts https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims[standard claims] from the https://openid.net/specs/openid-connect-core-1_0.html#IDToken[ID Token] based on the https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims[scopes requested] during authorization.
317+
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OidcUserInfoAuthenticationToken` and returns the `OidcUserInfo` response.
318+
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
303319

304320
[TIP]
305321
You can customize the ID Token by providing an xref:core-model-components.adoc#oauth2-token-customizer[`OAuth2TokenCustomizer<JwtEncodingContext>`] `@Bean`.
@@ -337,8 +353,10 @@ The guide xref:guides/how-to-userinfo.adoc#how-to-userinfo[How-to: Customize the
337353
[[oidc-client-registration-endpoint]]
338354
== OpenID Connect 1.0 Client Registration Endpoint
339355

340-
`OidcClientRegistrationEndpointConfigurer` configures the https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OpenID Connect 1.0 Client Registration endpoint].
341-
The following example shows how to enable (disabled by default) the OpenID Connect 1.0 Client Registration endpoint:
356+
`OidcClientRegistrationEndpointConfigurer` provides the ability to customize the https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OpenID Connect 1.0 Client Registration endpoint].
357+
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest[Client Registration requests] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadRequest[Client Read requests].
358+
359+
`OidcClientRegistrationEndpointConfigurer` provides the following configuration options:
342360

343361
[source,java]
344362
----
@@ -351,12 +369,26 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
351369
authorizationServerConfigurer
352370
.oidc(oidc ->
353371
oidc
354-
.clientRegistrationEndpoint(Customizer.withDefaults())
372+
.clientRegistrationEndpoint(clientRegistrationEndpoint ->
373+
clientRegistrationEndpoint
374+
.clientRegistrationRequestConverter(clientRegistrationRequestConverter) <1>
375+
.clientRegistrationRequestConverters(clientRegistrationRequestConvertersConsumers) <2>
376+
.authenticationProvider(authenticationProvider) <3>
377+
.authenticationProviders(authenticationProvidersConsumer) <4>
378+
.clientRegistrationResponseHandler(clientRegistrationResponseHandler) <5>
379+
.errorResponseHandler(errorResponseHandler) <6>
380+
)
355381
);
356382
357383
return http.build();
358384
}
359385
----
386+
<1> `clientRegistrationRequestConverter()`: Adds an `AuthenticationConverter` (_pre-processor_) used when attempting to extract a https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest[Client Registration request] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadRequest[Client Read request] from `HttpServletRequest` to an instance of `OidcClientRegistrationAuthenticationToken`.
387+
<2> `clientRegistrationRequestConverters()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationConverter``'s allowing the ability to add, remove, or customize a specific `AuthenticationConverter`.
388+
<3> `authenticationProvider()`: Adds an `AuthenticationProvider` (_main processor_) used for authenticating the `OidcClientRegistrationAuthenticationToken`.
389+
<4> `authenticationProviders()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationProvider``'s allowing the ability to add, remove, or customize a specific `AuthenticationProvider`.
390+
<5> `clientRegistrationResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse[Client Registration response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadResponse[Client Read response].
391+
<6> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationError[Client Registration Error response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadError[Client Read Error response].
360392

361393
[NOTE]
362394
The OpenID Connect 1.0 Client Registration endpoint is disabled by default because many deployments do not require dynamic client registration.
@@ -371,6 +403,8 @@ The OpenID Connect 1.0 Client Registration endpoint is disabled by default becau
371403

372404
* `*AuthenticationConverter*` -- An `OidcClientRegistrationAuthenticationConverter`.
373405
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OidcClientRegistrationAuthenticationProvider` and `OidcClientConfigurationAuthenticationProvider`.
406+
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returns the `OidcClientRegistration` response.
407+
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
374408

375409
The OpenID Connect 1.0 Client Registration endpoint is an https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OAuth2 protected resource], which *REQUIRES* an access token to be sent as a bearer token in the Client Registration (or Client Read) request.
376410

0 commit comments

Comments
 (0)