Skip to content

Commit a3fd551

Browse files
heruanrwinch
heruan
authored and
rwinch
committed
Add ClientRegistrations.fromOidcConfiguration method
ClientRegistrations now provides the fromOidcConfiguration method to create a ClientRegistration.Builder from a map representation of an OpenID Provider Configuration Response. This is useful when the OpenID Provider Configuration is not available at a well-known location, or if custom validation is needed for the issuer location (e.g. if the issuer is only reachable via a back-channel URI that is different from the issuer value in the configuration). Fixes: gh-14633
1 parent 1dd79c3 commit a3fd551

File tree

2 files changed

+154
-0
lines changed

2 files changed

+154
-0
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.java

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,46 @@ public final class ClientRegistrations {
7272
private ClientRegistrations() {
7373
}
7474

75+
/**
76+
* Creates a {@link ClientRegistration.Builder} using the provided map representation
77+
* of an <a href=
78+
* "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse">OpenID
79+
* Provider Configuration Response</a> to initialize the
80+
* {@link ClientRegistration.Builder}.
81+
*
82+
* <p>
83+
* This is useful when the OpenID Provider Configuration is not available at a
84+
* well-known location, or if custom validation is needed for the issuer location
85+
* (e.g. if the issuer is only accessible from a back-channel URI that is different
86+
* from the issuer value in the configuration).
87+
* </p>
88+
*
89+
* <p>
90+
* Example usage:
91+
* </p>
92+
* <pre>
93+
* RequestEntity&lt;Void&gt; request = RequestEntity.get(metadataEndpoint).build();
94+
* ParameterizedTypeReference&lt;Map&lt;String, Object&gt;&gt; typeReference = new ParameterizedTypeReference&lt;&gt;() {};
95+
* Map&lt;String, Object&gt; configuration = rest.exchange(request, typeReference).getBody();
96+
* // Validate configuration.get("issuer") as per in the OIDC specification
97+
* ClientRegistration registration = ClientRegistrations.fromOidcConfiguration(configuration)
98+
* .clientId("client-id")
99+
* .clientSecret("client-secret")
100+
* .build();
101+
* </pre>
102+
* @param the OpenID Provider configuration map
103+
* @return the {@link ClientRegistration} built from the configuration
104+
*/
105+
public static ClientRegistration.Builder fromOidcConfiguration(Map<String, Object> configuration) {
106+
OIDCProviderMetadata metadata = parse(configuration, OIDCProviderMetadata::parse);
107+
ClientRegistration.Builder builder = withProviderConfiguration(metadata, metadata.getIssuer().getValue());
108+
builder.jwkSetUri(metadata.getJWKSetURI().toASCIIString());
109+
if (metadata.getUserInfoEndpointURI() != null) {
110+
builder.userInfoUri(metadata.getUserInfoEndpointURI().toASCIIString());
111+
}
112+
return builder;
113+
}
114+
75115
/**
76116
* Creates a {@link ClientRegistration.Builder} using the provided <a href=
77117
* "https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a>

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/registration/ClientRegistrationsTests.java

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,120 @@ public void issuerWhenOAuth2ConfigurationDoesNotMatchThenMeaningfulErrorMessage(
455455
// @formatter:on
456456
}
457457

458+
@Test
459+
public void issuerWhenOidcConfigurationAllInformationThenSuccess() throws Exception {
460+
ClientRegistration registration = registration(this.response).build();
461+
ClientRegistration.ProviderDetails provider = registration.getProviderDetails();
462+
assertIssuerMetadata(registration, provider);
463+
assertThat(provider.getUserInfoEndpoint().getUri()).isEqualTo("https://example.com/oauth2/v3/userinfo");
464+
}
465+
466+
private ClientRegistration.Builder registration(Map<String, Object> configuration) {
467+
this.issuer = "https://example.com";
468+
return ClientRegistrations.fromOidcConfiguration(configuration)
469+
.clientId("client-id")
470+
.clientSecret("client-secret");
471+
}
472+
473+
@Test
474+
public void issuerWhenOidcConfigurationResponseMissingJwksUriThenThrowsIllegalArgumentException() throws Exception {
475+
this.response.remove("jwks_uri");
476+
assertThatIllegalArgumentException().isThrownBy(() -> registration(this.response).build())
477+
.withMessageContaining("The public JWK set URI must not be null");
478+
}
479+
480+
@Test
481+
public void issuerWhenOidcConfigurationResponseMissingUserInfoUriThenSuccess() throws Exception {
482+
this.response.remove("userinfo_endpoint");
483+
ClientRegistration registration = registration(this.response).build();
484+
assertThat(registration.getProviderDetails().getUserInfoEndpoint().getUri()).isNull();
485+
}
486+
487+
@Test
488+
public void issuerWhenOidcConfigurationGrantTypesSupportedNullThenDefaulted() throws Exception {
489+
this.response.remove("grant_types_supported");
490+
ClientRegistration registration = registration(this.response).build();
491+
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
492+
}
493+
494+
@Test
495+
public void issuerWhenOidcConfigurationImplicitGrantTypeThenSuccess() throws Exception {
496+
this.response.put("grant_types_supported", Arrays.asList("implicit"));
497+
ClientRegistration registration = registration(this.response).build();
498+
// The authorization_code grant type is still the default
499+
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
500+
}
501+
502+
@Test
503+
public void issuerWhenOidcConfigurationResponseAuthorizationEndpointIsNullThenSuccess() throws Exception {
504+
this.response.put("grant_types_supported", Arrays.asList("urn:ietf:params:oauth:grant-type:jwt-bearer"));
505+
this.response.remove("authorization_endpoint");
506+
ClientRegistration registration = registration(this.response)
507+
.authorizationGrantType(AuthorizationGrantType.JWT_BEARER)
508+
.build();
509+
assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.JWT_BEARER);
510+
ClientRegistration.ProviderDetails provider = registration.getProviderDetails();
511+
assertThat(provider.getAuthorizationUri()).isNull();
512+
}
513+
514+
@Test
515+
public void issuerWhenOidcConfigurationTokenEndpointAuthMethodsNullThenDefaulted() throws Exception {
516+
this.response.remove("token_endpoint_auth_methods_supported");
517+
ClientRegistration registration = registration(this.response).build();
518+
assertThat(registration.getClientAuthenticationMethod())
519+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
520+
}
521+
522+
@Test
523+
public void issuerWhenOidcConfigurationClientSecretBasicAuthMethodThenMethodIsBasic() throws Exception {
524+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("client_secret_basic"));
525+
ClientRegistration registration = registration(this.response).build();
526+
assertThat(registration.getClientAuthenticationMethod())
527+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
528+
}
529+
530+
@Test
531+
public void issuerWhenOidcConfigurationTokenEndpointAuthMethodsPostThenMethodIsPost() throws Exception {
532+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("client_secret_post"));
533+
ClientRegistration registration = registration(this.response).build();
534+
assertThat(registration.getClientAuthenticationMethod())
535+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_POST);
536+
}
537+
538+
@Test
539+
public void issuerWhenOidcConfigurationClientSecretJwtAuthMethodThenMethodIsClientSecretBasic() throws Exception {
540+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("client_secret_jwt"));
541+
ClientRegistration registration = registration(this.response).build();
542+
// The client_secret_basic auth method is still the default
543+
assertThat(registration.getClientAuthenticationMethod())
544+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
545+
}
546+
547+
@Test
548+
public void issuerWhenOidcConfigurationPrivateKeyJwtAuthMethodThenMethodIsClientSecretBasic() throws Exception {
549+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("private_key_jwt"));
550+
ClientRegistration registration = registration(this.response).build();
551+
// The client_secret_basic auth method is still the default
552+
assertThat(registration.getClientAuthenticationMethod())
553+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
554+
}
555+
556+
@Test
557+
public void issuerWhenOidcConfigurationTokenEndpointAuthMethodsNoneThenMethodIsNone() throws Exception {
558+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("none"));
559+
ClientRegistration registration = registration(this.response).build();
560+
assertThat(registration.getClientAuthenticationMethod()).isEqualTo(ClientAuthenticationMethod.NONE);
561+
}
562+
563+
@Test
564+
public void issuerWhenOidcConfigurationTlsClientAuthMethodThenSuccess() throws Exception {
565+
this.response.put("token_endpoint_auth_methods_supported", Arrays.asList("tls_client_auth"));
566+
ClientRegistration registration = registration(this.response).build();
567+
// The client_secret_basic auth method is still the default
568+
assertThat(registration.getClientAuthenticationMethod())
569+
.isEqualTo(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
570+
}
571+
458572
private ClientRegistration.Builder registration(String path) throws Exception {
459573
this.issuer = createIssuerFromServer(path);
460574
this.response.put("issuer", this.issuer);

0 commit comments

Comments
 (0)