Skip to content

Commit bfd7a09

Browse files
jgrandjajgrandja
committed
Polish gh-946 
1 parent efbfdc2 commit bfd7a09

File tree

5 files changed

+130
-120
lines changed

5 files changed

+130
-120
lines changed

‎docs/src/docs/asciidoc/protocol-endpoints.adoc

+9-7
Original file line numberDiff line numberDiff line change
@@ -353,8 +353,10 @@ The guide xref:guides/how-to-userinfo.adoc#how-to-userinfo[How-to: Customize the
353353
[[oidc-client-registration-endpoint]]
354354
== OpenID Connect 1.0 Client Registration Endpoint
355355

356-
`OidcClientRegistrationEndpointConfigurer` configures the https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OpenID Connect 1.0 Client Registration endpoint].
357-
The following example shows how to enable (disabled by default) the OpenID Connect 1.0 Client Registration endpoint:
356+
`OidcClientRegistrationEndpointConfigurer` provides the ability to customize the https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OpenID Connect 1.0 Client Registration endpoint].
357+
It defines extension points that let you customize the pre-processing, main processing, and post-processing logic for https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest[Client Registration requests] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadRequest[Client Read requests].
358+
359+
`OidcClientRegistrationEndpointConfigurer` provides the following configuration options:
358360

359361
[source,java]
360362
----
@@ -375,18 +377,18 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
375377
.authenticationProviders(authenticationProvidersConsumer) <4>
376378
.clientRegistrationResponseHandler(clientRegistrationResponseHandler) <5>
377379
.errorResponseHandler(errorResponseHandler) <6>
378-
)
380+
)
379381
);
380382
381383
return http.build();
382384
}
383385
----
384-
<1> `clientRegistrationRequestConverter()`: Adds an `AuthenticationConverter` (_pre-processor_) used when attempting to extract a https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest[Client Registration Request] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadRequest[Client Read Request] from `HttpServletRequest` to an instance of `OidcClientRegistrationAuthenticationToken`.
386+
<1> `clientRegistrationRequestConverter()`: Adds an `AuthenticationConverter` (_pre-processor_) used when attempting to extract a https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationRequest[Client Registration request] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadRequest[Client Read request] from `HttpServletRequest` to an instance of `OidcClientRegistrationAuthenticationToken`.
385387
<2> `clientRegistrationRequestConverters()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationConverter``'s allowing the ability to add, remove, or customize a specific `AuthenticationConverter`.
386388
<3> `authenticationProvider()`: Adds an `AuthenticationProvider` (_main processor_) used for authenticating the `OidcClientRegistrationAuthenticationToken`.
387389
<4> `authenticationProviders()`: Sets the `Consumer` providing access to the `List` of default and (optionally) added ``AuthenticationProvider``'s allowing the ability to add, remove, or customize a specific `AuthenticationProvider`.
388-
<5> `clientRegistrationResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse[Client Registration Response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadResponse[Client Read Response].
389-
<6> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationError[Client Registration Error Response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadError[Client Read Error Response].
390+
<5> `clientRegistrationResponseHandler()`: The `AuthenticationSuccessHandler` (_post-processor_) used for handling an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse[Client Registration response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadResponse[Client Read response].
391+
<6> `errorResponseHandler()`: The `AuthenticationFailureHandler` (_post-processor_) used for handling an `OAuth2AuthenticationException` and returning the https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationError[Client Registration Error response] or https://openid.net/specs/openid-connect-registration-1_0.html#ReadError[Client Read Error response].
390392

391393
[NOTE]
392394
The OpenID Connect 1.0 Client Registration endpoint is disabled by default because many deployments do not require dynamic client registration.
@@ -401,7 +403,7 @@ The OpenID Connect 1.0 Client Registration endpoint is disabled by default becau
401403

402404
* `*AuthenticationConverter*` -- An `OidcClientRegistrationAuthenticationConverter`.
403405
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OidcClientRegistrationAuthenticationProvider` and `OidcClientConfigurationAuthenticationProvider`.
404-
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returns the Client Registration or Client Read response.
406+
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OidcClientRegistrationAuthenticationToken` and returns the `OidcClientRegistration` response.
405407
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
406408

407409
The OpenID Connect 1.0 Client Registration endpoint is an https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[OAuth2 protected resource], which *REQUIRES* an access token to be sent as a bearer token in the Client Registration (or Client Read) request.

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcClientRegistrationEndpointConfigurer.java

+26-27
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2929
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3030
import org.springframework.security.oauth2.core.OAuth2Error;
31-
import org.springframework.security.oauth2.core.oidc.OidcUserInfo;
31+
import org.springframework.security.oauth2.server.authorization.oidc.OidcClientRegistration;
3232
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientConfigurationAuthenticationProvider;
3333
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientRegistrationAuthenticationProvider;
3434
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientRegistrationAuthenticationToken;
@@ -46,7 +46,7 @@
4646
import org.springframework.util.Assert;
4747

4848
/**
49-
* Configurer for OpenID Connect Dynamic Client Registration 1.0 Endpoint.
49+
* Configurer for OpenID Connect 1.0 Dynamic Client Registration Endpoint.
5050
*
5151
* @author Joe Grandja
5252
* @author Daniel Garnier-Moiroux
@@ -57,7 +57,7 @@
5757
public final class OidcClientRegistrationEndpointConfigurer extends AbstractOAuth2Configurer {
5858
private RequestMatcher requestMatcher;
5959
private final List<AuthenticationConverter> clientRegistrationRequestConverters = new ArrayList<>();
60-
private Consumer<List<AuthenticationConverter>> clientRegistrationRequestConvertersConsumer = (authenticationConverters) -> {};
60+
private Consumer<List<AuthenticationConverter>> clientRegistrationRequestConvertersConsumer = (clientRegistrationRequestConverters) -> {};
6161
private final List<AuthenticationProvider> authenticationProviders = new ArrayList<>();
6262
private Consumer<List<AuthenticationProvider>> authenticationProvidersConsumer = (authenticationProviders) -> {};
6363
private AuthenticationSuccessHandler clientRegistrationResponseHandler;
@@ -71,12 +71,10 @@ public final class OidcClientRegistrationEndpointConfigurer extends AbstractOAut
7171
}
7272

7373
/**
74-
* Sets the {@link AuthenticationConverter} used when attempting to extract the OIDC Client Registration Request
75-
* from {@link HttpServletRequest} to an instance of {@link OidcClientRegistrationAuthenticationToken} used for
76-
* creating the Client Registration or returning the Client Read Response.
74+
* Adds an {@link AuthenticationConverter} used when attempting to extract a Client Registration Request from {@link HttpServletRequest}
75+
* to an instance of {@link OidcClientRegistrationAuthenticationToken} used for authenticating the request.
7776
*
78-
* @param clientRegistrationRequestConverter the {@link AuthenticationConverter} used when attempting to extract an
79-
* OIDC Client Registration Request from {@link HttpServletRequest}
77+
* @param clientRegistrationRequestConverter an {@link AuthenticationConverter} used when attempting to extract a Client Registration Request from {@link HttpServletRequest}
8078
* @return the {@link OidcClientRegistrationEndpointConfigurer} for further configuration
8179
* @since 0.4.0
8280
*/
@@ -96,16 +94,17 @@ public OidcClientRegistrationEndpointConfigurer clientRegistrationRequestConvert
9694
* @return the {@link OidcUserInfoEndpointConfigurer} for further configuration
9795
* @since 0.4.0
9896
*/
99-
public OidcClientRegistrationEndpointConfigurer clientRegistrationRequestConverters(Consumer<List<AuthenticationConverter>> clientRegistrationRequestConvertersConsumer) {
97+
public OidcClientRegistrationEndpointConfigurer clientRegistrationRequestConverters(
98+
Consumer<List<AuthenticationConverter>> clientRegistrationRequestConvertersConsumer) {
10099
Assert.notNull(clientRegistrationRequestConvertersConsumer, "clientRegistrationRequestConvertersConsumer cannot be null");
101100
this.clientRegistrationRequestConvertersConsumer = clientRegistrationRequestConvertersConsumer;
102101
return this;
103102
}
104103

105104
/**
106-
* Adds an {@link AuthenticationProvider} used for authenticating a type of {@link OidcClientRegistrationAuthenticationToken}.
105+
* Adds an {@link AuthenticationProvider} used for authenticating an {@link OidcClientRegistrationAuthenticationToken}.
107106
*
108-
* @param authenticationProvider a {@link AuthenticationProvider} used for authenticating a type of {@link OidcClientRegistrationAuthenticationToken}
107+
* @param authenticationProvider an {@link AuthenticationProvider} used for authenticating an {@link OidcClientRegistrationAuthenticationToken}
109108
* @return the {@link OidcClientRegistrationEndpointConfigurer} for further configuration
110109
* @since 0.4.0
111110
*/
@@ -132,8 +131,8 @@ public OidcClientRegistrationEndpointConfigurer authenticationProviders(
132131
}
133132

134133
/**
135-
* Sets the {@link AuthenticationSuccessHandler} used for handling an {@link OidcClientRegistrationAuthenticationToken} and
136-
* returning the {@link OidcUserInfo User Info Response}.
134+
* Sets the {@link AuthenticationSuccessHandler} used for handling an {@link OidcClientRegistrationAuthenticationToken}
135+
* and returning the {@link OidcClientRegistration Client Registration Response}.
137136
*
138137
* @param clientRegistrationResponseHandler the {@link AuthenticationSuccessHandler} used for handling an {@link OidcClientRegistrationAuthenticationToken}
139138
* @return the {@link OidcClientRegistrationEndpointConfigurer} for further configuration
@@ -145,8 +144,8 @@ public OidcClientRegistrationEndpointConfigurer clientRegistrationResponseHandle
145144
}
146145

147146
/**
148-
* Sets the {@link AuthenticationFailureHandler} used for handling an {@link OAuth2AuthenticationException} and
149-
* returning the {@link OAuth2Error Error Response}.
147+
* Sets the {@link AuthenticationFailureHandler} used for handling an {@link OAuth2AuthenticationException}
148+
* and returning the {@link OAuth2Error Error Response}.
150149
*
151150
* @param errorResponseHandler the {@link AuthenticationFailureHandler} used for handling an {@link OAuth2AuthenticationException}
152151
* @return the {@link OidcClientRegistrationEndpointConfigurer} for further configuration
@@ -160,18 +159,17 @@ public OidcClientRegistrationEndpointConfigurer errorResponseHandler(Authenticat
160159
@Override
161160
void init(HttpSecurity httpSecurity) {
162161
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
162+
String clientRegistrationEndpointUri = authorizationServerSettings.getOidcClientRegistrationEndpoint();
163163
this.requestMatcher = new OrRequestMatcher(
164-
new AntPathRequestMatcher(authorizationServerSettings.getOidcClientRegistrationEndpoint(), HttpMethod.POST.name()),
165-
new AntPathRequestMatcher(authorizationServerSettings.getOidcClientRegistrationEndpoint(), HttpMethod.GET.name())
164+
new AntPathRequestMatcher(clientRegistrationEndpointUri, HttpMethod.POST.name()),
165+
new AntPathRequestMatcher(clientRegistrationEndpointUri, HttpMethod.GET.name())
166166
);
167167

168168
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
169-
170169
if (!this.authenticationProviders.isEmpty()) {
171170
authenticationProviders.addAll(0, this.authenticationProviders);
172171
}
173172
this.authenticationProvidersConsumer.accept(authenticationProviders);
174-
175173
authenticationProviders.forEach(authenticationProvider ->
176174
httpSecurity.authenticationProvider(postProcess(authenticationProvider)));
177175
}
@@ -185,15 +183,13 @@ void configure(HttpSecurity httpSecurity) {
185183
new OidcClientRegistrationEndpointFilter(
186184
authenticationManager,
187185
authorizationServerSettings.getOidcClientRegistrationEndpoint());
188-
189186
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
190187
if (!this.clientRegistrationRequestConverters.isEmpty()) {
191188
authenticationConverters.addAll(0, this.clientRegistrationRequestConverters);
192189
}
193190
this.clientRegistrationRequestConvertersConsumer.accept(authenticationConverters);
194191
oidcClientRegistrationEndpointFilter.setAuthenticationConverter(
195192
new DelegatingAuthenticationConverter(authenticationConverters));
196-
197193
if (this.clientRegistrationResponseHandler != null) {
198194
oidcClientRegistrationEndpointFilter
199195
.setAuthenticationSuccessHandler(this.clientRegistrationResponseHandler);
@@ -209,6 +205,14 @@ RequestMatcher getRequestMatcher() {
209205
return this.requestMatcher;
210206
}
211207

208+
private static List<AuthenticationConverter> createDefaultAuthenticationConverters() {
209+
List<AuthenticationConverter> authenticationConverters = new ArrayList<>();
210+
211+
authenticationConverters.add(new OidcClientRegistrationAuthenticationConverter());
212+
213+
return authenticationConverters;
214+
}
215+
212216
private static List<AuthenticationProvider> createDefaultAuthenticationProviders(HttpSecurity httpSecurity) {
213217
List<AuthenticationProvider> authenticationProviders = new ArrayList<>();
214218

@@ -224,13 +228,8 @@ private static List<AuthenticationProvider> createDefaultAuthenticationProviders
224228
OAuth2ConfigurerUtils.getRegisteredClientRepository(httpSecurity),
225229
OAuth2ConfigurerUtils.getAuthorizationService(httpSecurity));
226230
authenticationProviders.add(oidcClientConfigurationAuthenticationProvider);
227-
return authenticationProviders;
228-
}
229231

230-
private static List<AuthenticationConverter> createDefaultAuthenticationConverters() {
231-
List<AuthenticationConverter> authenticationConverters = new ArrayList<>();
232-
authenticationConverters.add(new OidcClientRegistrationAuthenticationConverter());
233-
return authenticationConverters;
232+
return authenticationProviders;
234233
}
235234

236235
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcClientRegistrationEndpointFilter.java

+13-18
Original file line numberDiff line numberDiff line change
@@ -74,11 +74,11 @@ public final class OidcClientRegistrationEndpointFilter extends OncePerRequestFi
7474

7575
private final AuthenticationManager authenticationManager;
7676
private final RequestMatcher clientRegistrationEndpointMatcher;
77-
private AuthenticationConverter authenticationConverter = new OidcClientRegistrationAuthenticationConverter();
7877
private final HttpMessageConverter<OidcClientRegistration> clientRegistrationHttpMessageConverter =
7978
new OidcClientRegistrationHttpMessageConverter();
8079
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
8180
new OAuth2ErrorHttpMessageConverter();
81+
private AuthenticationConverter authenticationConverter = new OidcClientRegistrationAuthenticationConverter();
8282
private AuthenticationSuccessHandler authenticationSuccessHandler = this::sendClientRegistrationResponse;
8383
private AuthenticationFailureHandler authenticationFailureHandler = this::sendErrorResponse;
8484

@@ -130,19 +130,18 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
130130
}
131131

132132
try {
133-
OidcClientRegistrationAuthenticationToken clientRegistrationAuthentication =
134-
(OidcClientRegistrationAuthenticationToken) this.authenticationConverter.convert(request);
133+
Authentication clientRegistrationAuthentication = this.authenticationConverter.convert(request);
135134

136-
OidcClientRegistrationAuthenticationToken clientRegistrationAuthenticationResult =
137-
(OidcClientRegistrationAuthenticationToken) this.authenticationManager.authenticate(clientRegistrationAuthentication);
135+
Authentication clientRegistrationAuthenticationResult =
136+
this.authenticationManager.authenticate(clientRegistrationAuthentication);
138137

139138
this.authenticationSuccessHandler.onAuthenticationSuccess(request, response, clientRegistrationAuthenticationResult);
140139
} catch (OAuth2AuthenticationException ex) {
141140
this.authenticationFailureHandler.onAuthenticationFailure(request, response, ex);
142141
} catch (Exception ex) {
143142
OAuth2Error error = new OAuth2Error(
144143
OAuth2ErrorCodes.INVALID_REQUEST,
145-
"OpenID Client Registration Error: " + ex.getMessage(),
144+
"OpenID Connect 1.0 Client Registration Error: " + ex.getMessage(),
146145
"https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationError");
147146
this.authenticationFailureHandler.onAuthenticationFailure(request, response,
148147
new OAuth2AuthenticationException(error));
@@ -152,12 +151,10 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
152151
}
153152

154153
/**
155-
* Sets the {@link AuthenticationConverter} used when attempting to extract the OIDC Client Registration Request
156-
* from {@link HttpServletRequest} to an instance of {@link OidcClientRegistrationAuthenticationToken} used for
157-
* creating the Client Registration or returning the Client Read Response.
154+
* Sets the {@link AuthenticationConverter} used when attempting to extract a Client Registration Request from {@link HttpServletRequest}
155+
* to an instance of {@link OidcClientRegistrationAuthenticationToken} used for authenticating the request.
158156
*
159-
* @param authenticationConverter the {@link AuthenticationConverter} used when attempting to extract an
160-
* OIDC Client Registration Request from {@link HttpServletRequest}
157+
* @param authenticationConverter an {@link AuthenticationConverter} used when attempting to extract a Client Registration Request from {@link HttpServletRequest}
161158
* @since 0.4.0
162159
*/
163160
public void setAuthenticationConverter(AuthenticationConverter authenticationConverter) {
@@ -178,11 +175,10 @@ public void setAuthenticationSuccessHandler(AuthenticationSuccessHandler authent
178175
}
179176

180177
/**
181-
* Sets the {@link AuthenticationFailureHandler} used for handling an
182-
* {@link OAuth2AuthenticationException} and returning the {@link OAuth2Error Error
183-
* Response}.
184-
* @param authenticationFailureHandler the {@link AuthenticationFailureHandler} used
185-
* for handling an {@link OAuth2AuthenticationException}
178+
* Sets the {@link AuthenticationFailureHandler} used for handling an {@link OAuth2AuthenticationException}
179+
* and returning the {@link OAuth2Error Error Response}.
180+
*
181+
* @param authenticationFailureHandler the {@link AuthenticationFailureHandler} used for handling an {@link OAuth2AuthenticationException}
186182
* @since 0.4.0
187183
*/
188184
public void setAuthenticationFailureHandler(AuthenticationFailureHandler authenticationFailureHandler) {
@@ -197,8 +193,7 @@ private void sendClientRegistrationResponse(HttpServletRequest request, HttpServ
197193
ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
198194
if (HttpMethod.POST.name().equals(request.getMethod())) {
199195
httpResponse.setStatusCode(HttpStatus.CREATED);
200-
}
201-
else {
196+
} else {
202197
httpResponse.setStatusCode(HttpStatus.OK);
203198
}
204199
this.clientRegistrationHttpMessageConverter.write(clientRegistration, null, httpResponse);

0 commit comments

Comments
 (0)