Implement Token Endpoint

[jgrandja]

An authorization server provides a token endpoint, which the client uses to exchange an authorization grant for an access token.

The OAuth2TokenEndpointFilter should be implemented as a Filter. The DefaultAuthorizationCodeTokenResponseClient in the spring-security-oauth2-client module is the client that calls the Token Endpoint.

Implementation Requirements

• the Filter should process requests for the (default) path /oauth2/token
• authorizationGrantConverter should convert a valid authorization_code Access Token Request to OAuth2AuthorizationCodeAuthenticationToken Implement authorization_code AuthenticationProvider #68
• the OAuth2AuthorizationCodeAuthenticationToken should be passed to the AuthenticationManager
• the AuthenticationManager should be composed of OAuth2AuthorizationCodeAuthenticationProvider Implement authorization_code AuthenticationProvider #68
• OAuth2AccessTokenAuthenticationToken Implement authorization_code AuthenticationProvider #68 should be returned from AuthenticationManager
• the OAuth2AccessToken should be updated in the in-flight OAuth2Authorization Implement Authorization Model / Service #43
• javadoc class and public methods
• Unit tests

Specification References

3.1. Token Endpoint
4.1. Authorization Code Grant
4.1.3. Access Token Request
4.1.4. Access Token Response

[kratostaine]

@jgrandja May I pick this up?

[jgrandja]

Thank you @kratostaine. The issue is yours.

[jgrandja]

@kratostaine How are things coming along with the PR? Do you have any questions or do you need any help?

[kratostaine]

@jgrandja Thank you for enquiring. I don't have any questions right now and am going as per the RFC 6749 spec. Will reach out whenever I have any doubts.

[kratostaine]

authorizationGrantConverter should convert a valid authorization_code Access Token Request to OAuth2AuthorizationCodeAuthenticationToken

@jgrandja Have a query regarding this. How should the code in the access token request be validated as a valid auth code?

[kratostaine]

OAuth2AccessTokenAuthenticationToken #68 should be returned from AuthenticationManager

@jgrandja Also regarding the above, I understand that OAuth2AuthorizationCodeAuthenticationProvider would be returning OAuth2AccessTokenAuthenticationToken object, but it has no method to return an object of OAuth2AccessTokenAuthenticationToken type, rather just the Authentication interface type. Should I expect there to be a different method which returns OAuth2AccessTokenAuthenticationToken object?

[jgrandja]

@kratostaine

How should the code in the access token request be validated as a valid auth code?

The OAuth2AuthorizationCodeAuthenticationProvider is responsible for validating the code. This will be implemented by #68.

The authorizationGrantConverter should simply attempt to convert the access token request parameters to a OAuth2AuthorizationCodeAuthenticationToken and then pass it to the AuthenticationManager. If the request is NOT a access token request then the authorizationGrantConverter should return null and the Filter will continue on with the chain.

I understand that OAuth2AuthorizationCodeAuthenticationProvider would be returning OAuth2AccessTokenAuthenticationToken object, but it has no method to return an object of OAuth2AccessTokenAuthenticationToken type, rather just the Authentication interface type

The OAuth2TokenEndpointFilter will ultimately call AuthenticationManager.authenticate() passing OAuth2AuthorizationCodeAuthenticationToken and expecting the return value to be OAuth2AccessTokenAuthenticationToken - just cast it to this type.

[kratostaine]

If the request is NOT a access token request then the authorizationGrantConverter should return null and the Filter will continue on with the chain.

@jgrandja regarding this, instead of having authorizationGrantConverter return null when the request is not an access token request, isn't it better to pass the request to the converter only if it's an access token request, and filter out the other requests? I planned on that way. Your thoughts please?

[jgrandja]

@kratostaine

isn't it better to pass the request to the converter only if it's an access token request

Yes, thanks for clarifying this. Typically, a Filter would use a RequestMatcher to determine if it should handle the request. So the OAuth2TokenEndpointFilter will use a RequestMatcher to match on a valid Access Token Request and if matched pass it to authorizationGrantConverter.