Create spring-boot-security-oauth2-resource-server module

This commit is contained in:
Andy Wilkinson 2025-03-31 12:58:44 +01:00
parent b37a1e765d
commit 18457a79ab
42 changed files with 117 additions and 90 deletions

View File

@ -102,6 +102,7 @@ include "spring-boot-project:spring-boot-reactor-netty"
include "spring-boot-project:spring-boot-rsocket"
include "spring-boot-project:spring-boot-security"
include "spring-boot-project:spring-boot-security-oauth2-client"
include "spring-boot-project:spring-boot-security-oauth2-resource-server"
include "spring-boot-project:spring-boot-sendgrid"
include "spring-boot-project:spring-boot-test"
include "spring-boot-project:spring-boot-test-autoconfigure"

View File

@ -49,6 +49,7 @@ dependencies {
optional(project(":spring-boot-project:spring-boot-r2dbc"))
optional(project(":spring-boot-project:spring-boot-reactor-netty"))
optional(project(":spring-boot-project:spring-boot-security-oauth2-client"))
optional(project(":spring-boot-project:spring-boot-security-oauth2-resource-server"))
optional(project(":spring-boot-project:spring-boot-tomcat"))
optional(project(":spring-boot-project:spring-boot-undertow"))
optional(project(":spring-boot-project:spring-boot-validation"))

View File

@ -28,7 +28,6 @@ import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration;
import org.springframework.context.annotation.Bean;
@ -56,9 +55,10 @@ import static org.springframework.security.config.Customizer.withDefaults;
*/
@AutoConfiguration(before = ReactiveSecurityAutoConfiguration.class,
after = { HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class,
WebEndpointAutoConfiguration.class, ReactiveOAuth2ResourceServerAutoConfiguration.class,
ReactiveUserDetailsServiceAutoConfiguration.class },
afterName = "org.springframework.boot.security.oauth2.client.autoconfigure.reactive.ReactiveOAuth2ClientWebSecurityAutoConfiguration")
WebEndpointAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class },
afterName = {
"org.springframework.boot.security.oauth2.client.autoconfigure.reactive.ReactiveOAuth2ClientWebSecurityAutoConfiguration",
"org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive.ReactiveOAuth2ResourceServerAutoConfiguration" })
@ConditionalOnClass({ EnableWebFluxSecurity.class, WebFilterChainProxy.class })
@ConditionalOnMissingBean({ SecurityWebFilterChain.class, WebFilterChainProxy.class })
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.REACTIVE)

View File

@ -16,7 +16,6 @@
package org.springframework.boot.actuate.autoconfigure.security.servlet;
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.health.HealthEndpointAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration;
import org.springframework.boot.actuate.endpoint.web.WebServerNamespace;
@ -24,7 +23,6 @@ import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity;
import org.springframework.boot.security.autoconfigure.SecurityProperties;
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
@ -50,10 +48,10 @@ import static org.springframework.security.config.Customizer.withDefaults;
* @since 2.1.0
*/
@AutoConfiguration(before = SecurityAutoConfiguration.class,
after = { HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class,
WebEndpointAutoConfiguration.class, OAuth2ResourceServerAutoConfiguration.class },
after = { HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class },
afterName = { "org.springframework.boot.security.autoconfigure.saml2.Saml2RelyingPartyAutoConfiguration",
"org.springframework.boot.security.oauth2.client.autoconfigure.servlet.OAuth2ClientWebSecurityAutoConfiguration" })
"org.springframework.boot.security.oauth2.client.autoconfigure.servlet.OAuth2ClientWebSecurityAutoConfiguration",
"org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration" })
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
@ConditionalOnDefaultWebSecurity
public class ManagementWebSecurityAutoConfiguration {

View File

@ -31,9 +31,9 @@ import org.springframework.boot.actuate.autoconfigure.health.HealthContributorAu
import org.springframework.boot.actuate.autoconfigure.health.HealthEndpointAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration;
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
import org.springframework.context.ApplicationContext;

View File

@ -29,10 +29,10 @@ import org.springframework.boot.actuate.autoconfigure.health.HealthContributorAu
import org.springframework.boot.actuate.autoconfigure.health.HealthEndpointAutoConfiguration;
import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.security.autoconfigure.SecurityProperties;
import org.springframework.boot.security.autoconfigure.saml2.Saml2RelyingPartyAutoConfiguration;
import org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.test.context.FilteredClassLoader;
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;

View File

@ -56,6 +56,7 @@ dependencies {
optional(project(":spring-boot-project:spring-boot-reactor-netty"))
optional(project(":spring-boot-project:spring-boot-rsocket"))
optional(project(":spring-boot-project:spring-boot-security"))
optional(project(":spring-boot-project:spring-boot-security-oauth2-resource-server"))
optional(project(":spring-boot-project:spring-boot-tomcat"))
optional(project(":spring-boot-project:spring-boot-tx"))
optional(project(":spring-boot-project:spring-boot-validation"))

View File

@ -20,7 +20,6 @@ import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration;
import org.springframework.context.annotation.Import;
import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
@ -41,8 +40,7 @@ import org.springframework.security.oauth2.server.authorization.OAuth2Authorizat
* @since 3.1.0
* @see OAuth2AuthorizationServerJwtAutoConfiguration
*/
@AutoConfiguration(before = OAuth2ResourceServerAutoConfiguration.class, beforeName = {
"org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration",
@AutoConfiguration(beforeName = { "org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration",
"org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration" })
@ConditionalOnClass(OAuth2Authorization.class)
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)

View File

@ -454,14 +454,6 @@
"level": "error"
}
},
{
"name": "spring.security.oauth2.resourceserver.jwt.jws-algorithm",
"type": "java.lang.String",
"deprecation": {
"replacement": "spring.security.oauth2.resourceserver.jwt.jws-algorithms",
"level": "error"
}
},
{
"name": "spring.session.redis.cleanup-cron",
"defaultValue": "0 * * * * *"

View File

@ -16,8 +16,6 @@ org.springframework.boot.autoconfigure.http.client.reactive.ClientHttpConnectorA
org.springframework.boot.autoconfigure.http.codec.CodecsAutoConfiguration
org.springframework.boot.autoconfigure.netty.NettyAutoConfiguration
org.springframework.boot.autoconfigure.reactor.ReactorAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.server.servlet.OAuth2AuthorizationServerAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.server.servlet.OAuth2AuthorizationServerJwtAutoConfiguration
org.springframework.boot.autoconfigure.session.SessionAutoConfiguration

View File

@ -2077,6 +2077,7 @@ bom {
"spring-boot-rsocket",
"spring-boot-security",
"spring-boot-security-oauth2-client",
"spring-boot-security-oauth2-resource-server",
"spring-boot-sendgrid",
"spring-boot-starter",
"spring-boot-starter-activemq",

View File

@ -107,6 +107,7 @@ dependencies {
autoConfiguration(project(path: ":spring-boot-project:spring-boot-rsocket", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-security", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-security-oauth2-client", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-security-oauth2-resource-server", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-sendgrid", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-testcontainers", configuration: "autoConfigurationMetadata"))
autoConfiguration(project(path: ":spring-boot-project:spring-boot-thymeleaf", configuration: "autoConfigurationMetadata"))
@ -172,6 +173,7 @@ dependencies {
configurationProperties(project(path: ":spring-boot-project:spring-boot-rsocket", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-security", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-security-oauth2-client", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-security-oauth2-resource-server", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-sendgrid", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-test-autoconfigure", configuration: "configurationPropertiesMetadata"))
configurationProperties(project(path: ":spring-boot-project:spring-boot-testcontainers", configuration: "configurationPropertiesMetadata"))

View File

@ -0,0 +1,30 @@
plugins {
id "java-library"
id "org.springframework.boot.auto-configuration"
id "org.springframework.boot.configuration-properties"
id "org.springframework.boot.deployed"
id "org.springframework.boot.optional-dependencies"
}
description = "Spring Boot Security OAuth2 Resource Server"
dependencies {
api(project(":spring-boot-project:spring-boot"))
api("org.springframework.security:spring-security-oauth2-jose")
api("org.springframework.security:spring-security-oauth2-resource-server")
implementation(project(":spring-boot-project:spring-boot-security"))
optional(project(":spring-boot-project:spring-boot-autoconfigure"))
optional("io.projectreactor:reactor-core")
optional("jakarta.servlet:jakarta.servlet-api")
testImplementation(project(":spring-boot-project:spring-boot-test"))
testImplementation(project(":spring-boot-project:spring-boot-tools:spring-boot-test-support"))
testImplementation(project(":spring-boot-project:spring-boot-webmvc"))
testImplementation("com.fasterxml.jackson.core:jackson-databind")
testImplementation("com.squareup.okhttp3:mockwebserver")
testRuntimeOnly("ch.qos.logback:logback-classic")
testRuntimeOnly("org.springframework:spring-webflux")
}

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
@ -30,9 +30,8 @@ import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
* issuer-location-based JWT decoder} should be used.
*
* @author Andy Wilkinson
* @since 3.5.0
* @since 4.0.0
*/
@SuppressWarnings("removal")
@Retention(RetentionPolicy.RUNTIME)
@Target({ ElementType.TYPE, ElementType.METHOD })
@Documented

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
@ -30,9 +30,8 @@ import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
* JWT decoder} should be used.
*
* @author Andy Wilkinson
* @since 3.5.0
* @since 4.0.0
*/
@SuppressWarnings("removal")
@Retention(RetentionPolicy.RUNTIME)
@Target({ ElementType.TYPE, ElementType.METHOD })
@Documented

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import org.springframework.boot.autoconfigure.condition.ConditionMessage;
import org.springframework.boot.autoconfigure.condition.ConditionOutcome;
@ -29,12 +29,8 @@ import org.springframework.util.StringUtils;
* Condition for creating {@link JwtDecoder} by oidc issuer location.
*
* @author Artsiom Yudovin
* @since 2.1.0
* @deprecated since 3.5.0 for removal in 4.0.0 in favor of
* {@link ConditionalOnIssuerLocationJwtDecoder @ConditionalOnIssuerLocationJwtDecoder}
*/
@Deprecated(since = "3.5.0", forRemoval = true)
public class IssuerUriCondition extends SpringBootCondition {
class IssuerUriCondition extends SpringBootCondition {
@Override
public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) {

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import org.springframework.boot.autoconfigure.condition.ConditionMessage;
import org.springframework.boot.autoconfigure.condition.ConditionOutcome;
@ -28,12 +28,8 @@ import org.springframework.util.StringUtils;
* Condition for creating a jwt decoder using a public key value.
*
* @author Madhura Bhave
* @since 2.2.0
* @deprecated since 3.5.0 for removal in 4.0.0 in favor of
* {@link ConditionalOnPublicKeyJwtDecoder @ConditionalOnPublicKeyJwtDecoder}
*/
@Deprecated(since = "3.5.0", forRemoval = true)
public class KeyValueCondition extends SpringBootCondition {
class KeyValueCondition extends SpringBootCondition {
@Override
public ConditionOutcome getMatchOutcome(ConditionContext context, AnnotatedTypeMetadata metadata) {

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import java.io.IOException;
import java.io.InputStream;
@ -35,7 +35,7 @@ import org.springframework.util.StreamUtils;
* @author Artsiom Yudovin
* @author Mushtaq Ahmed
* @author Yan Kardziyaka
* @since 2.1.0
* @since 4.0.0
*/
@ConfigurationProperties("spring.security.oauth2.resourceserver")
public class OAuth2ResourceServerProperties {

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -17,4 +17,4 @@
/**
* Support for Spring Security's OAuth2 resource server.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2023 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder.JwkSetUriReactiveJwtDecoderBuilder;
import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
@ -26,7 +26,7 @@ import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
* obtained through an issuer URI.
*
* @author Andy Wilkinson
* @since 3.1.0
* @since 4.0.0
*/
@FunctionalInterface
public interface JwkSetUriReactiveJwtDecoderBuilderCustomizer {

View File

@ -14,16 +14,16 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.security.autoconfigure.reactive.ReactiveSecurityAutoConfiguration;
import org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Import;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
@ -32,7 +32,7 @@ import org.springframework.security.config.annotation.web.reactive.EnableWebFlux
* support.
*
* @author Madhura Bhave
* @since 2.1.0
* @since 4.0.0
*/
@AutoConfiguration(
before = { ReactiveSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class })

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2024 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.context.annotation.Configuration;

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import java.security.KeyFactory;
import java.security.interfaces.RSAPublicKey;
@ -30,10 +30,10 @@ import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.resource.ConditionalOnIssuerLocationJwtDecoder;
import org.springframework.boot.autoconfigure.security.oauth2.resource.ConditionalOnPublicKeyJwtDecoder;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnIssuerLocationJwtDecoder;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnPublicKeyJwtDecoder;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;

View File

@ -14,12 +14,12 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.web.server.ServerHttpSecurity;

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -17,4 +17,4 @@
/**
* Auto-configuration for Spring Security's Reactive OAuth2 resource server.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2023 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder;
@ -25,7 +25,7 @@ import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDeco
* configured directly or obtained through an issuer URI.
*
* @author Andy Wilkinson
* @since 3.1.0
* @since 4.0.0
*/
@FunctionalInterface
public interface JwkSetUriJwtDecoderBuilderCustomizer {

View File

@ -14,14 +14,14 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Import;
import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
@ -29,7 +29,7 @@ import org.springframework.security.oauth2.server.resource.authentication.Bearer
* {@link EnableAutoConfiguration Auto-configuration} for OAuth2 resource server support.
*
* @author Madhura Bhave
* @since 2.1.0
* @since 4.0.0
*/
@AutoConfiguration(beforeName = { "org.springframework.boot.security.autoconfigure.servlet.SecurityAutoConfiguration",
"org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration" })

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import java.security.KeyFactory;
import java.security.interfaces.RSAPublicKey;
@ -30,11 +30,11 @@ import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.resource.ConditionalOnIssuerLocationJwtDecoder;
import org.springframework.boot.autoconfigure.security.oauth2.resource.ConditionalOnPublicKeyJwtDecoder;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnIssuerLocationJwtDecoder;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.ConditionalOnPublicKeyJwtDecoder;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;

View File

@ -14,13 +14,13 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.security.autoconfigure.ConditionalOnDefaultWebSecurity;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.OAuth2ResourceServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2024 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.context.annotation.Configuration;

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -17,4 +17,4 @@
/**
* Auto-configuration for Spring Security's OAuth2 resource server.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;

View File

@ -0,0 +1,13 @@
{
"groups": [],
"properties": [
{
"name": "spring.security.oauth2.resourceserver.jwt.jws-algorithm",
"type": "java.lang.String",
"deprecation": {
"replacement": "spring.security.oauth2.resourceserver.jwt.jws-algorithms",
"level": "error"
}
}
]
}

View File

@ -0,0 +1,2 @@
org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration
org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive.ReactiveOAuth2ResourceServerAutoConfiguration

View File

@ -1,5 +1,5 @@
/*
* Copyright 2012-2024 the original author or authors.
* Copyright 2012-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure;
import java.time.Instant;
import java.util.UUID;

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.reactive;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive;
import java.io.IOException;
import java.lang.annotation.ElementType;
@ -49,7 +49,7 @@ import org.mockito.InOrder;
import reactor.core.publisher.Mono;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.JwtConverterCustomizationsArgumentsProvider;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider;
import org.springframework.boot.test.context.FilteredClassLoader;
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;

View File

@ -14,7 +14,7 @@
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.oauth2.resource.servlet;
package org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
@ -47,7 +47,7 @@ import org.junit.jupiter.params.provider.ArgumentsSource;
import org.mockito.InOrder;
import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.security.oauth2.resource.JwtConverterCustomizationsArgumentsProvider;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.JwtConverterCustomizationsArgumentsProvider;
import org.springframework.boot.test.context.FilteredClassLoader;
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;

View File

@ -6,6 +6,5 @@ description = "Starter for using Spring Security's OAuth2 resource server featur
dependencies {
api(project(":spring-boot-project:spring-boot-starters:spring-boot-starter-security"))
api("org.springframework.security:spring-security-oauth2-resource-server")
api("org.springframework.security:spring-security-oauth2-jose")
api(project(":spring-boot-project:spring-boot-security-oauth2-resource-server"))
}

View File

@ -64,6 +64,7 @@ dependencies {
optional(project(":spring-boot-project:spring-boot-reactor-netty"))
optional(project(":spring-boot-project:spring-boot-security"))
optional(project(":spring-boot-project:spring-boot-security-oauth2-client"))
optional(project(":spring-boot-project:spring-boot-security-oauth2-resource-server"))
optional(project(":spring-boot-project:spring-boot-tx"))
optional(project(":spring-boot-project:spring-boot-validation"))
optional(project(":spring-boot-project:spring-boot-webmvc"))

View File

@ -3,5 +3,5 @@ optional:org.springframework.boot.security.autoconfigure.reactive.ReactiveSecuri
optional:org.springframework.boot.security.autoconfigure.reactive.ReactiveUserDetailsServiceAutoConfiguration
optional:org.springframework.boot.security.oauth2.client.autoconfigure.reactive.ReactiveOAuth2ClientAutoConfiguration
optional:org.springframework.boot.security.oauth2.client.autoconfigure.reactive.ReactiveOAuth2ClientWebSecurityAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
optional:org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
org.springframework.boot.test.autoconfigure.web.reactive.WebTestClientAutoConfiguration

View File

@ -4,9 +4,9 @@ optional:org.springframework.boot.security.autoconfigure.servlet.SecurityFilterA
optional:org.springframework.boot.security.autoconfigure.servlet.UserDetailsServiceAutoConfiguration
optional:org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration
optional:org.springframework.boot.security.oauth2.client.autoconfigure.servlet.OAuth2ClientWebSecurityAutoConfiguration
optional:org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration
org.springframework.boot.test.autoconfigure.web.servlet.MockMvcAutoConfiguration
org.springframework.boot.test.autoconfigure.web.servlet.MockMvcWebClientAutoConfiguration
org.springframework.boot.test.autoconfigure.web.servlet.MockMvcWebDriverAutoConfiguration
org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration
org.springframework.boot.test.autoconfigure.web.servlet.MockMvcSecurityConfiguration
org.springframework.boot.test.autoconfigure.web.reactive.WebTestClientAutoConfiguration

View File

@ -20,11 +20,11 @@ import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.context.MessageSourceAutoConfiguration;
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.web.reactive.error.ErrorWebFluxAutoConfiguration;
import org.springframework.boot.freemarker.autoconfigure.FreeMarkerAutoConfiguration;
import org.springframework.boot.mustache.autoconfigure.MustacheAutoConfiguration;
import org.springframework.boot.security.oauth2.client.autoconfigure.reactive.ReactiveOAuth2ClientAutoConfiguration;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.test.autoconfigure.web.reactive.WebFluxTest;
import org.springframework.boot.thymeleaf.autoconfigure.ThymeleafAutoConfiguration;
import org.springframework.boot.validation.autoconfigure.ValidationAutoConfiguration;

View File

@ -19,13 +19,13 @@ package org.springframework.boot.test.autoconfigure.web.servlet;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.task.TaskExecutionAutoConfiguration;
import org.springframework.boot.autoconfigure.web.servlet.HttpEncodingAutoConfiguration;
import org.springframework.boot.freemarker.autoconfigure.FreeMarkerAutoConfiguration;
import org.springframework.boot.groovy.template.autoconfigure.GroovyTemplateAutoConfiguration;
import org.springframework.boot.mustache.autoconfigure.MustacheAutoConfiguration;
import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration;
import org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.thymeleaf.autoconfigure.ThymeleafAutoConfiguration;
import org.springframework.context.ApplicationContext;
import org.springframework.core.task.AsyncTaskExecutor;