Skip to content

Commit 970ce39

Browse files
author
Steve Riesenberg
committed
Implement User Info Endpoint
Closes spring-projectsgh-176
1 parent 8e8979a commit 970ce39

File tree

16 files changed

+1822
-3
lines changed

16 files changed

+1822
-3
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcConfigurer.java

+17-1
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,15 @@
4040
*/
4141
public final class OidcConfigurer extends AbstractOAuth2Configurer {
4242
private OidcClientRegistrationEndpointConfigurer clientRegistrationEndpointConfigurer;
43+
private final OidcUserInfoEndpointConfigurer userInfoEndpointConfigurer;
4344
private RequestMatcher requestMatcher;
4445

4546
/**
4647
* Restrict for internal use only.
4748
*/
4849
OidcConfigurer(ObjectPostProcessor<Object> objectPostProcessor) {
4950
super(objectPostProcessor);
51+
this.userInfoEndpointConfigurer = new OidcUserInfoEndpointConfigurer(objectPostProcessor);
5052
}
5153

5254
/**
@@ -63,11 +65,23 @@ public OidcConfigurer clientRegistrationEndpoint(Customizer<OidcClientRegistrati
6365
return this;
6466
}
6567

68+
/**
69+
* Configures the OAuth 2.0 Protected Resource UserInfo Endpoint.
70+
*
71+
* @param userInfoEndpointCustomizer the {@link Customizer} providing access to the {@link OidcUserInfoEndpointConfigurer}
72+
* @return the {@link OidcConfigurer} for further configuration
73+
*/
74+
public OidcConfigurer userInfoEndpoint(Customizer<OidcUserInfoEndpointConfigurer> userInfoEndpointCustomizer) {
75+
userInfoEndpointCustomizer.customize(this.userInfoEndpointConfigurer);
76+
return this;
77+
}
78+
6679
@Override
6780
<B extends HttpSecurityBuilder<B>> void init(B builder) {
6881
if (this.clientRegistrationEndpointConfigurer != null) {
6982
this.clientRegistrationEndpointConfigurer.init(builder);
7083
}
84+
this.userInfoEndpointConfigurer.init(builder);
7185

7286
List<RequestMatcher> requestMatchers = new ArrayList<>();
7387
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
@@ -78,14 +92,16 @@ <B extends HttpSecurityBuilder<B>> void init(B builder) {
7892
if (this.clientRegistrationEndpointConfigurer != null) {
7993
requestMatchers.add(this.clientRegistrationEndpointConfigurer.getRequestMatcher());
8094
}
81-
this.requestMatcher = !requestMatchers.isEmpty() ? new OrRequestMatcher(requestMatchers) : request -> false;
95+
requestMatchers.add(this.userInfoEndpointConfigurer.getRequestMatcher());
96+
this.requestMatcher = requestMatchers.size() > 1 ? new OrRequestMatcher(requestMatchers) : requestMatchers.get(0);
8297
}
8398

8499
@Override
85100
<B extends HttpSecurityBuilder<B>> void configure(B builder) {
86101
if (this.clientRegistrationEndpointConfigurer != null) {
87102
this.clientRegistrationEndpointConfigurer.configure(builder);
88103
}
104+
this.userInfoEndpointConfigurer.configure(builder);
89105

90106
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
91107
if (providerSettings.getIssuer() != null) {

‎oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcUserInfoEndpointConfigurer.java

+118
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
/*
2+
* Copyright 2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;
17+
18+
import java.util.function.Function;
19+
20+
import javax.servlet.http.HttpServletRequest;
21+
22+
import org.springframework.http.HttpMethod;
23+
import org.springframework.security.authentication.AuthenticationManager;
24+
import org.springframework.security.config.annotation.ObjectPostProcessor;
25+
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
26+
import org.springframework.security.core.Authentication;
27+
import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
28+
import org.springframework.security.oauth2.server.authorization.config.ProviderSettings;
29+
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcUserInfoAuthenticationProvider;
30+
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcUserInfoAuthenticationToken;
31+
import org.springframework.security.oauth2.server.authorization.oidc.web.OidcUserInfoEndpointFilter;
32+
import org.springframework.security.web.authentication.AuthenticationConverter;
33+
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
34+
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
35+
import org.springframework.security.web.util.matcher.OrRequestMatcher;
36+
import org.springframework.security.web.util.matcher.RequestMatcher;
37+
38+
/**
39+
* Configurer for OAuth 2.0 Protected Resource UserInfo Endpoint.
40+
*
41+
* @author Steve Riesenberg
42+
* @since 0.2.1
43+
* @see OidcConfigurer#userInfoEndpoint
44+
* @see OidcUserInfoEndpointFilter
45+
*/
46+
public final class OidcUserInfoEndpointConfigurer extends AbstractOAuth2Configurer {
47+
private RequestMatcher requestMatcher;
48+
private AuthenticationConverter authenticationConverter;
49+
private Function<Authentication, OidcUserInfo> userInfoMapper;
50+
51+
/**
52+
* Restrict for internal use only.
53+
*/
54+
OidcUserInfoEndpointConfigurer(ObjectPostProcessor<Object> objectPostProcessor) {
55+
super(objectPostProcessor);
56+
}
57+
58+
/**
59+
* Sets the {@link AuthenticationConverter} used when attempting to extract a bearer token from {@link HttpServletRequest}
60+
* to an instance of {@link OidcUserInfoAuthenticationToken} used for authenticating the request.
61+
*
62+
* @param authenticationConverter the {@link AuthenticationConverter} used when attempting to extract a bearer token from {@link HttpServletRequest}
63+
* @return the {@link OidcUserInfoEndpointConfigurer} for further configuration
64+
*/
65+
public OidcUserInfoEndpointConfigurer authenticationConverter(AuthenticationConverter authenticationConverter) {
66+
this.authenticationConverter = authenticationConverter;
67+
return this;
68+
}
69+
70+
/**
71+
* Sets the {@link Function} used to extract claims from an {@link Authentication}
72+
* to an instance of {@link OidcUserInfo}.
73+
*
74+
* @param userInfoMapper the {@link Function} used to extract claims from an {@link Authentication} to an instance of {@link OidcUserInfo}
75+
* @return the {@link OidcUserInfoEndpointConfigurer} for further configuration
76+
*/
77+
public OidcUserInfoEndpointConfigurer userInfoMapper(Function<Authentication, OidcUserInfo> userInfoMapper) {
78+
this.userInfoMapper = userInfoMapper;
79+
return this;
80+
}
81+
82+
@Override
83+
<B extends HttpSecurityBuilder<B>> void init(B builder) {
84+
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
85+
String userInfoEndpointUri = providerSettings.getOidcUserInfoEndpoint();
86+
this.requestMatcher = new OrRequestMatcher(
87+
new AntPathRequestMatcher(userInfoEndpointUri, HttpMethod.GET.name()),
88+
new AntPathRequestMatcher(userInfoEndpointUri, HttpMethod.POST.name()));
89+
90+
OidcUserInfoAuthenticationProvider oidcUserInfoAuthenticationProvider =
91+
new OidcUserInfoAuthenticationProvider(
92+
OAuth2ConfigurerUtils.getAuthorizationService(builder));
93+
builder.authenticationProvider(postProcess(oidcUserInfoAuthenticationProvider));
94+
}
95+
96+
@Override
97+
<B extends HttpSecurityBuilder<B>> void configure(B builder) {
98+
AuthenticationManager authenticationManager = builder.getSharedObject(AuthenticationManager.class);
99+
ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
100+
101+
OidcUserInfoEndpointFilter oidcUserInfoEndpointFilter =
102+
new OidcUserInfoEndpointFilter(
103+
authenticationManager,
104+
providerSettings.getOidcUserInfoEndpoint());
105+
if (this.authenticationConverter != null) {
106+
oidcUserInfoEndpointFilter.setAuthenticationConverter(this.authenticationConverter);
107+
}
108+
if (this.userInfoMapper != null) {
109+
oidcUserInfoEndpointFilter.setUserInfoMapper(this.userInfoMapper);
110+
}
111+
builder.addFilterAfter(postProcess(oidcUserInfoEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
112+
}
113+
114+
@Override
115+
RequestMatcher getRequestMatcher() {
116+
return this.requestMatcher;
117+
}
118+
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/http/converter/OidcUserInfoHttpMessageConverter.java

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
/*
2+
* Copyright 2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.oauth2.core.oidc.http.converter;
17+
18+
import java.util.HashMap;
19+
import java.util.Map;
20+
21+
import org.springframework.core.ParameterizedTypeReference;
22+
import org.springframework.core.convert.TypeDescriptor;
23+
import org.springframework.core.convert.converter.Converter;
24+
import org.springframework.http.HttpInputMessage;
25+
import org.springframework.http.HttpOutputMessage;
26+
import org.springframework.http.MediaType;
27+
import org.springframework.http.converter.AbstractHttpMessageConverter;
28+
import org.springframework.http.converter.GenericHttpMessageConverter;
29+
import org.springframework.http.converter.HttpMessageConverter;
30+
import org.springframework.http.converter.HttpMessageNotReadableException;
31+
import org.springframework.http.converter.HttpMessageNotWritableException;
32+
import org.springframework.security.oauth2.core.converter.ClaimConversionService;
33+
import org.springframework.security.oauth2.core.converter.ClaimTypeConverter;
34+
import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
35+
import org.springframework.security.oauth2.core.oidc.StandardClaimNames;
36+
import org.springframework.util.Assert;
37+
38+
/**
39+
* A {@link HttpMessageConverter} for an {@link OidcUserInfo OAuth 2.0 Protected Resource UserInfo Response}.
40+
*
41+
* @author Steve Riesenberg
42+
* @since 0.2.1
43+
* @see AbstractHttpMessageConverter
44+
* @see OidcUserInfo
45+
*/
46+
public class OidcUserInfoHttpMessageConverter extends AbstractHttpMessageConverter<OidcUserInfo> {
47+
48+
private static final ParameterizedTypeReference<Map<String, Object>> STRING_OBJECT_MAP =
49+
new ParameterizedTypeReference<Map<String, Object>>() {};
50+
51+
private final GenericHttpMessageConverter<Object> jsonMessageConverter =
52+
HttpMessageConverters.getJsonMessageConverter();
53+
54+
private Converter<Map<String, Object>, OidcUserInfo> userInfoConverter = new OidcUserInfoConverter();
55+
private Converter<OidcUserInfo, Map<String, Object>> userInfoParametersConverter = OidcUserInfo::getClaims;
56+
57+
public OidcUserInfoHttpMessageConverter() {
58+
super(MediaType.APPLICATION_JSON, new MediaType("application", "*+json"));
59+
}
60+
61+
@Override
62+
protected boolean supports(Class<?> clazz) {
63+
return OidcUserInfo.class.isAssignableFrom(clazz);
64+
}
65+
66+
@Override
67+
@SuppressWarnings("unchecked")
68+
protected OidcUserInfo readInternal(Class<? extends OidcUserInfo> clazz, HttpInputMessage inputMessage)
69+
throws HttpMessageNotReadableException {
70+
try {
71+
Map<String, Object> userInfoParameters =
72+
(Map<String, Object>) this.jsonMessageConverter.read(STRING_OBJECT_MAP.getType(), null, inputMessage);
73+
return this.userInfoConverter.convert(userInfoParameters);
74+
} catch (Exception ex) {
75+
throw new HttpMessageNotReadableException(
76+
"An error occurred reading the UserInfo: " + ex.getMessage(), ex, inputMessage);
77+
}
78+
}
79+
80+
@Override
81+
protected void writeInternal(OidcUserInfo oidcUserInfo, HttpOutputMessage outputMessage)
82+
throws HttpMessageNotWritableException {
83+
try {
84+
Map<String, Object> userInfoResponseParameters =
85+
this.userInfoParametersConverter.convert(oidcUserInfo);
86+
this.jsonMessageConverter.write(
87+
userInfoResponseParameters,
88+
STRING_OBJECT_MAP.getType(),
89+
MediaType.APPLICATION_JSON,
90+
outputMessage
91+
);
92+
} catch (Exception ex) {
93+
throw new HttpMessageNotWritableException(
94+
"An error occurred writing the OAuth 2.0 Protected Resource UserInfo response: " + ex.getMessage(), ex);
95+
}
96+
}
97+
98+
/**
99+
* Sets the {@link Converter} used for converting the UserInfo parameters
100+
* to an {@link OidcUserInfo}.
101+
*
102+
* @param userInfoConverter the {@link Converter} used for converting to an
103+
* {@link OidcUserInfo}
104+
*/
105+
public final void setUserInfoConverter(Converter<Map<String, Object>, OidcUserInfo> userInfoConverter) {
106+
Assert.notNull(userInfoConverter, "userInfoConverter cannot be null");
107+
this.userInfoConverter = userInfoConverter;
108+
}
109+
110+
/**
111+
* Sets the {@link Converter} used for converting the {@link OidcUserInfo} to a
112+
* {@code Map} representation of the UserInfo.
113+
*
114+
* @param userInfoParametersConverter the {@link Converter} used for converting to a
115+
* {@code Map} representation of the UserInfo
116+
*/
117+
public final void setUserInfoParametersConverter(
118+
Converter<OidcUserInfo, Map<String, Object>> userInfoParametersConverter) {
119+
Assert.notNull(userInfoParametersConverter, "oidcUserInfoParametersConverter cannot be null");
120+
this.userInfoParametersConverter = userInfoParametersConverter;
121+
}
122+
123+
private static final class OidcUserInfoConverter implements Converter<Map<String, Object>, OidcUserInfo> {
124+
private static final ClaimConversionService CLAIM_CONVERSION_SERVICE = ClaimConversionService.getSharedInstance();
125+
private static final TypeDescriptor OBJECT_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(Object.class);
126+
private static final TypeDescriptor BOOLEAN_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(Boolean.class);
127+
private static final TypeDescriptor STRING_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(String.class);
128+
private static final TypeDescriptor STRING_OBJECT_MAP_DESCRIPTOR = TypeDescriptor.map(Map.class, STRING_TYPE_DESCRIPTOR, OBJECT_TYPE_DESCRIPTOR);
129+
private final ClaimTypeConverter claimTypeConverter;
130+
131+
private OidcUserInfoConverter() {
132+
Converter<Object, ?> stringConverter = getConverter(STRING_TYPE_DESCRIPTOR);
133+
Converter<Object, ?> booleanConverter = getConverter(BOOLEAN_TYPE_DESCRIPTOR);
134+
Converter<Object, ?> mapConverter = getConverter(STRING_OBJECT_MAP_DESCRIPTOR);
135+
136+
Map<String, Converter<Object, ?>> claimConverters = new HashMap<>();
137+
claimConverters.put(StandardClaimNames.SUB, stringConverter);
138+
claimConverters.put(StandardClaimNames.NAME, stringConverter);
139+
claimConverters.put(StandardClaimNames.GIVEN_NAME, stringConverter);
140+
claimConverters.put(StandardClaimNames.FAMILY_NAME, stringConverter);
141+
claimConverters.put(StandardClaimNames.MIDDLE_NAME, stringConverter);
142+
claimConverters.put(StandardClaimNames.NICKNAME, stringConverter);
143+
claimConverters.put(StandardClaimNames.PREFERRED_USERNAME, stringConverter);
144+
claimConverters.put(StandardClaimNames.PROFILE, stringConverter);
145+
claimConverters.put(StandardClaimNames.PICTURE, stringConverter);
146+
claimConverters.put(StandardClaimNames.WEBSITE, stringConverter);
147+
claimConverters.put(StandardClaimNames.EMAIL, stringConverter);
148+
claimConverters.put(StandardClaimNames.EMAIL_VERIFIED, booleanConverter);
149+
claimConverters.put(StandardClaimNames.GENDER, stringConverter);
150+
claimConverters.put(StandardClaimNames.BIRTHDATE, stringConverter);
151+
claimConverters.put(StandardClaimNames.ZONEINFO, stringConverter);
152+
claimConverters.put(StandardClaimNames.LOCALE, stringConverter);
153+
claimConverters.put(StandardClaimNames.PHONE_NUMBER, stringConverter);
154+
claimConverters.put(StandardClaimNames.PHONE_NUMBER_VERIFIED, booleanConverter);
155+
claimConverters.put(StandardClaimNames.ADDRESS, mapConverter);
156+
claimConverters.put(StandardClaimNames.UPDATED_AT, stringConverter);
157+
158+
this.claimTypeConverter = new ClaimTypeConverter(claimConverters);
159+
}
160+
161+
@Override
162+
public OidcUserInfo convert(Map<String, Object> source) {
163+
Map<String, Object> parsedClaims = this.claimTypeConverter.convert(source);
164+
return new OidcUserInfo(parsedClaims);
165+
}
166+
167+
private static Converter<Object, ?> getConverter(TypeDescriptor targetDescriptor) {
168+
return (source) -> CLAIM_CONVERSION_SERVICE.convert(source, OBJECT_TYPE_DESCRIPTOR, targetDescriptor);
169+
}
170+
}
171+
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/ConfigurationSettingNames.java

+5
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,11 @@ public static final class Provider {
9494
*/
9595
public static final String OIDC_CLIENT_REGISTRATION_ENDPOINT = PROVIDER_SETTINGS_NAMESPACE.concat("oidc-client-registration-endpoint");
9696

97+
/**
98+
* Set the Provider's OAuth 2.0 Protected Resource UserInfo endpoint.
99+
*/
100+
public static final String OIDC_USER_INFO_ENDPOINT = PROVIDER_SETTINGS_NAMESPACE.concat("oidc-user-info-endpoint");
101+
97102
private Provider() {
98103
}
99104

0 commit comments

Comments
 (0)