Commit Graph

1479 Commits

Author SHA1 Message Date
Max Batischev 4967f3feee Add Support BearerTokenAuthenticationConverter
Closes gh-14750

Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-06-04 18:17:17 -06:00
Josh Cummings d52e0b6a05
Polish NimbusJwtDecoder
- Aligned JwkSourceJwtDecoderBuilder's relative position with its
corresponding static factory
- Added @since to JwkSourceJwtDecoderBuilder

PR gh-17046
2025-06-02 15:53:59 -06:00
Mark Bonnekessel ada75e76a6 Add builder to create NimbusJwtDecoder with JwkSource
Signed-off-by: Mark Bonnekessel <2949525+marbon87@users.noreply.github.com>
2025-06-02 13:33:39 -06:00
Pat McCusker 5517d8fe3a Deprecate the X5T JOSE Header name
CodeQL Advanced / codeql-analysis-call (push) Waiting to run Details
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Has been cancelled Details
Closes gh-16979

Signed-off-by: Pat McCusker <patmccusker14@gmail.com>
2025-05-30 06:45:02 -06:00
Josh Cummings 6d3b54df21
Change Type Validation Default
CodeQL Advanced / codeql-analysis-call (push) Waiting to run Details
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
NimbusJwtDecoder and NimbusReactiveJwtDecoder now use
Spring Security's JwtTypeValidator by default instead
of Nimbus's type validator.

Closes gh-17181
2025-05-28 16:11:13 -06:00
Maximilian Klose ec05e65668 Add Equals and HashCode methods for better comparison.
Closes gh-16394

Signed-off-by: Maximilian Klose <maximilian.klose@adesso.de>
2025-05-27 13:53:07 -06:00
Ferenc Kemeny bf05b8b430 Support Requiring exp and nbf in JwtTimestampsValidator
Closes gh-17004

Signed-off-by: Ferenc Kemeny <ferenc.kemeny79+oss@gmail.com>
2025-05-27 12:22:25 -06:00
Ferenc Kemeny 91b21663db Polish JwtTimestampValidatorTests
This commit corrects the test that checks for both
nbf and exp missing. It also adds one for just exp
and on for just nbf.

Issue gh-17004

Signed-off-by: Ferenc Kemeny <ferenc.kemeny79+oss@gmail.com>
2025-05-27 12:22:25 -06:00
Joe Grandja a8edcca961 Merge branch '6.5.x' 2025-05-14 05:36:04 -04:00
Joe Grandja 5f7155bfc7 Implement internal cache in JtiClaimValidator
Closes gh-17107
2025-05-14 05:21:00 -04:00
Joe Grandja 44303d2c80 Polish gh-17080 2025-05-13 14:36:44 -04:00
David Kowis 462e38c0e3 Fix DPoP jkt claim to be JWK SHA-256 thumbprint
Just used the nimbus JOSE library to do it, because it already has a
compliant implementation.

Closes gh-17080

Signed-off-by: David Kowis <david@kow.is>
2025-05-13 14:36:44 -04:00
Joe Grandja a265ac6ae7 Polish gh-17080
CodeQL Advanced / Analyze (${{ matrix.language }}) (none, actions) (push) Waiting to run Details
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
2025-05-13 14:35:23 -04:00
David Kowis 2090f44f74 Fix DPoP jkt claim to be JWK SHA-256 thumbprint
Just used the nimbus JOSE library to do it, because it already has a
compliant implementation.

Closes gh-17080

Signed-off-by: David Kowis <david@kow.is>
2025-05-13 14:35:23 -04:00
Joe Grandja ba7be9c8b9 Merge branch '6.5.x'
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
CodeQL Advanced / Analyze (${{ matrix.language }}) (none, actions) (push) Has been cancelled Details
Deploy Docs / build (push) Has been cancelled Details
2025-05-09 16:14:34 -04:00
Joe Grandja e3c39f02bc Add documentation for DPoP support
CodeQL Advanced / Analyze (${{ matrix.language }}) (none, actions) (push) Has been cancelled Details
CI / Build (17, ubuntu-latest) (push) Has been cancelled Details
CI / Build (17, windows-latest) (push) Has been cancelled Details
CI / Test Against Snapshots (17, 17) (push) Has been cancelled Details
CI / Test Against Snapshots (21-ea, 21) (push) Has been cancelled Details
CI / Check Samples (push) Has been cancelled Details
Deploy Docs / build (push) Has been cancelled Details
CI / Deploy Artifacts (push) Has been cancelled Details
CI / Deploy Docs (push) Has been cancelled Details
CI / Deploy Schema (push) Has been cancelled Details
CI / Perform Release (push) Has been cancelled Details
CI / Send Notification (push) Has been cancelled Details
Closes gh-17072
2025-05-09 16:02:14 -04:00
Tran Ngoc Nhan 48eb243012 Update javadoc
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-05-07 14:59:14 -05:00
Tran Ngoc Nhan 1e4dd713c5 Remove APPLICATION_JSON_UTF8 usage
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-05-07 14:59:14 -05:00
Rob Winch b453840c0a
HttpHeaders no longer a MultiValueMap
Closes gh-17060
2025-05-06 13:27:13 -05:00
Rob Winch 2dbf3a2d18
WebClient.exchange->exchangeToMono
Closes gh-17057
2025-05-06 13:26:16 -05:00
Rob Winch 5704582c52
ResponseErrorHandler.handleError(URI, HttpMethod,ClientHttpResponse)
Closes gh-17056
2025-05-06 13:26:16 -05:00
Rob Winch 11105a5c51
UriComponentsBuilder.fromHttpUrl->fromUriString
The fromHttpUrl method is deprecated and replaced with fromUriString

Closes gh-
2025-05-06 13:26:15 -05:00
Rob Winch cb0fdef236
Remove MediaType.APPLICATION_JSON_UTF
Closes gh-17050
2025-05-06 13:26:14 -05:00
hammadirshad 1a4602c8c3 Add mapping for DPoP in DefaultMapOAuth2AccessTokenResponseConverter
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
Closes gh-16806

Signed-off-by: muha <muha@kreftregisteret.no>
2025-04-30 10:09:41 -04:00
Josh Cummings 804d79d96a
Merge branch '6.4.x' 2025-04-29 14:27:47 -06:00
Josh Cummings a4126aa27d
Merge branch '6.3.x' into 6.4.x 2025-04-29 14:27:40 -06:00
Josh Cummings f631a0fcd5
Polish ClientRegistrationsTests
Simplified the assertion so that it is focused on the core
behavior being verified. This will likely also make the test
more stable when updating Spring Framework versions.

Issue gh-16860
2025-04-29 14:27:04 -06:00
Josh Cummings fe6ddd0c8f
Merge branch '6.4.x' 2025-04-29 14:26:44 -06:00
Josh Cummings 656ad72608
Merge branch '6.3.x' into 6.4.x
Closes gh-17016
2025-04-29 14:22:52 -06:00
Evgeniy Cheban 0e84f31a00 Add ClientRegistration's RestClient failed attempts information to exception message
Closes gh-16860

Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>
2025-04-29 13:43:20 -06:00
Josh Cummings eecd7d9559
Update Deprecated Reactor Usage 2025-04-23 12:11:08 -06:00
Josh Cummings 834370d8eb
Update Deprecated Spring Web Usage 2025-04-23 11:29:19 -06:00
Joe Grandja 19090e7873 Add request_uri in OAuth2ParameterNames
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
Closes gh-16947
2025-04-16 10:23:10 -04:00
Joe Grandja 791feee355 Prevent downgraded usage of DPoP-bound access tokens
Issue gh-16574

Closes gh-16937
2025-04-14 15:54:41 -04:00
Joe Grandja 1ca33cae70 Make DPoP IatClaimValidator public to allow configuring clock and clockSkew
Issue gh-16574

Closes gh-16921
2025-04-10 16:04:37 -04:00
Risto Virtanen 47e1fc045f Formatted
Signed-off-by: Risto Virtanen <818702+mapsu@users.noreply.github.com>
2025-04-09 17:09:54 -06:00
Risto Virtanen 1db557e395 Replace ClientRegistrationMixinTests with StdConvertersTest
Signed-off-by: Risto Virtanen <818702+mapsu@users.noreply.github.com>
2025-04-09 17:09:54 -06:00
Risto Virtanen 368fe2e7a0 Add missing ClientAuthenticationMethods to jackson2 converter
Closes gh-16825

Signed-off-by: Risto Virtanen <818702+mapsu@users.noreply.github.com>
2025-04-09 17:09:54 -06:00
Steve Riesenberg 9d442c13de
Mark password grant for removal
This commit also updates link to the document "Best Current Practice for
OAuth 2.0 Security" to point to RFC 9700.

Closes gh-16913
2025-04-09 11:15:09 -05:00
Steve Riesenberg 197ee38aa0
Mark deprecated response clients for removal
Issue gh-16913
2025-04-09 11:15:06 -05:00
Tran Ngoc Nhan d864e51ff6 Format OpaqueTokenIntrospector
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-04-08 13:56:54 -05:00
Tran Ngoc Nhan d899bc5240 Polish javadoc
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-04-08 13:56:54 -05:00
Steve Riesenberg 1fb3fc80f9
Polish gh-15819
Closes gh-15818
2025-04-07 10:57:49 -05:00
Jonah Klöckner 9674532f4d
Add support for access token in body parameter as per rfc 6750 Sec. 2.2
Issue gh-15818
2025-04-07 10:57:49 -05:00
Steve Riesenberg 03e090c2d7
Merge branch '6.4.x'
Closes gh-16902
2025-04-07 10:57:12 -05:00
Steve Riesenberg db34de59bc
Merge branch '6.3.x' into 6.4.x
CI / Build (17, ubuntu-latest) (push) Has been cancelled Details
CI / Build (17, windows-latest) (push) Has been cancelled Details
CI / Test Against Snapshots (17, 17) (push) Has been cancelled Details
CI / Test Against Snapshots (21-ea, 21) (push) Has been cancelled Details
CI / Check Samples (push) Has been cancelled Details
Deploy Docs / build (push) Has been cancelled Details
Trigger Dependabot Auto Merge Forward / Trigger Workflow (push) Has been cancelled Details
CI / Deploy Artifacts (push) Has been cancelled Details
CI / Deploy Docs (push) Has been cancelled Details
CI / Deploy Schema (push) Has been cancelled Details
CI / Perform Release (push) Has been cancelled Details
CI / Send Notification (push) Has been cancelled Details
Closes gh-16901
2025-04-07 10:55:51 -05:00
Steve Riesenberg 3c0fef59b5
Polish gh-16039
CI / Build (17, ubuntu-latest) (push) Has been cancelled Details
CI / Build (17, windows-latest) (push) Has been cancelled Details
CI / Test Against Snapshots (17, 17) (push) Has been cancelled Details
CI / Test Against Snapshots (21-ea, 21) (push) Has been cancelled Details
CI / Check Samples (push) Has been cancelled Details
Deploy Docs / build (push) Has been cancelled Details
Trigger Dependabot Auto Merge Forward / Trigger Workflow (push) Has been cancelled Details
CI / Deploy Artifacts (push) Has been cancelled Details
CI / Deploy Docs (push) Has been cancelled Details
CI / Deploy Schema (push) Has been cancelled Details
CI / Perform Release (push) Has been cancelled Details
CI / Send Notification (push) Has been cancelled Details
Closes gh-16038
2025-04-07 10:54:09 -05:00
Jonah Klöckner da94fbe431
Evaluate URI query parameter only if enabled
Issue gh-16038
2025-04-07 10:54:07 -05:00
Josh Cummings 2885b0f75f Add valueOf
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
This commit adds a static factory for returning a constant
ClientAuthenticationMethod or creating a new one when there
is no match.

Issue gh-16825
2025-04-02 11:16:30 -06:00
Tran Ngoc Nhan 7bca17cb5a Polish
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-03-26 17:02:06 -06:00
Josh Cummings 99345537d6
Add RequestMatcher Migration Path for AbstractAuthenticationProcessingFilter
Issue gh-16417
2025-03-26 16:38:39 -06:00
Steve Riesenberg 860f130bc4
Add additional validation when refreshing ID tokens
Issue gh-16589
2025-03-26 15:34:17 -05:00
Steve Riesenberg 5f98ce5ecc
Polish gh-16589 2025-03-26 15:34:17 -05:00
Josh Cummings de07b1108f
Use PathPatternRequestMatcher in Web Components
This commit changes filters and resolvers that were using AntPathRequestMatcher as their
default to using PathPatternRequestMatcher.

Issue gh-16632
2025-03-26 13:28:58 -06:00
Josh Cummings 56e757a2a1 Provide Authentication to AuthenticationExceptions
Deploy Docs / build (push) Has been cancelled Details
Execute Gradle Wrapper Upgrade / Execution (push) Has been cancelled Details
Update Antora UI Spring / Update on Supported Branches (5.8.x) (push) Has been cancelled Details
Update Antora UI Spring / Update on Supported Branches (6.2.x) (push) Has been cancelled Details
Update Antora UI Spring / Update on Supported Branches (6.3.x) (push) Has been cancelled Details
Update Antora UI Spring / Update on Supported Branches (main) (push) Has been cancelled Details
Update Antora UI Spring / Update on docs-build (push) Has been cancelled Details
CI / Build (17, ubuntu-latest) (push) Has been cancelled Details
CI / Build (17, windows-latest) (push) Has been cancelled Details
CI / Test Against Snapshots (17, 17) (push) Has been cancelled Details
CI / Test Against Snapshots (21-ea, 21) (push) Has been cancelled Details
CI / Check Samples (push) Has been cancelled Details
Clean build artifacts / main (push) Has been cancelled Details
CI / Deploy Artifacts (push) Has been cancelled Details
CI / Deploy Docs (push) Has been cancelled Details
CI / Deploy Schema (push) Has been cancelled Details
CI / Perform Release (push) Has been cancelled Details
CI / Send Notification (push) Has been cancelled Details
Issue gh-16444
2025-03-21 21:54:32 -06:00
Steve Riesenberg 3ebcbd4375
Merge branch '6.4.x'
Closes gh-16788
Closes gh-16789
Closes gh-16790
Closes gh-16791
Closes gh-16792
2025-03-20 14:47:07 -05:00
Steve Riesenberg 96cfbd1e6c
Merge branch '6.3.x' into 6.4.x
CI / Build (17, ubuntu-latest) (push) Waiting to run Details
CI / Build (17, windows-latest) (push) Waiting to run Details
CI / Test Against Snapshots (17, 17) (push) Waiting to run Details
CI / Test Against Snapshots (21-ea, 21) (push) Waiting to run Details
CI / Check Samples (push) Waiting to run Details
CI / Deploy Artifacts (push) Blocked by required conditions Details
CI / Deploy Docs (push) Blocked by required conditions Details
CI / Deploy Schema (push) Blocked by required conditions Details
CI / Perform Release (push) Blocked by required conditions Details
CI / Send Notification (push) Blocked by required conditions Details
Deploy Docs / build (push) Waiting to run Details
Trigger Dependabot Auto Merge Forward / Trigger Workflow (push) Waiting to run Details
Closes gh-16782
Closes gh-16783
Closes gh-16784
Closes gh-16785
Closes gh-16786
2025-03-20 14:46:18 -05:00
Tran Ngoc Nhan a53ca7c3d0
Update ServerOAuth2AuthorizedClientExchangeFilterFunction javadoc
Closes gh-16555

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-03-20 14:38:09 -05:00
Josh Cummings cfe70a5fc7 Restore authorizedClientParametersMapper Assertion
Issue gh-16726
2025-03-19 18:13:54 -06:00
Max Batischev 6c24a1e717 Improve JdbcOAuth2AuthorizedClientService saveAuthorizedClient
Closes gh-16726

Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-03-19 18:13:54 -06:00
Steve Riesenberg 5bb5d0f6be Polish gh-16589 2025-03-18 18:07:56 -05:00
Hao fc1469ad5e Ensure ID Token is updated after refresh token
Signed-off-by: Hao <kyrieeeee2@gmail.com>
2025-03-18 18:07:56 -05:00
Rob Winch e6223dede3
Merge branch '6.4.x'
- adb303e Add testRuntimeOnly junit-platform-launcher

Closes gh-16757
2025-03-17 14:34:18 -05:00
Rob Winch 05116eabbd
Merge branch '6.3.x' into 6.4.x
- adb303e Add testRuntimeOnly junit-platform-launcher

Closes gh-16756
2025-03-17 14:18:49 -05:00
Rob Winch adb303e152
Add testRuntimeOnly junit-platform-launcher
Closes gh-16755
2025-03-17 14:16:44 -05:00
Steve Riesenberg 0938ca01a4
Add support for automatic context-propagation with Micrometer
Closes gh-16665
2025-03-13 15:29:08 -05:00
Vedran Pavic 401e237082 Introduce JwtAudienceValidator
Signed-off-by: Vedran Pavic <vedran@vedranpavic.com>
2025-02-28 12:38:18 -07:00
Josh Cummings 7df85a2ed9 Polish NimbusJwtDecoder 2025-02-27 12:40:01 -07:00
Josh Cummings ab43a660b9 Add RFC 9068 Support
Closes gh-13185
2025-02-27 12:40:01 -07:00
Josh Cummings 81e2fd2fe8 Add Type Validation
Closes gh-16672
2025-02-27 12:40:01 -07:00
Josh Cummings eb5252c4f0
Merge branch '6.4.x' 2025-02-24 17:03:13 -07:00
Pat McCusker 2bd3cadde8 Use possessive pronoun rather contraction
Signed-off-by: Pat McCusker <patmccusker14@gmail.com>
2025-02-24 17:02:45 -07:00
Pat McCusker bfce6e438d Add fourth oauth grant type to javadoc
Signed-off-by: Pat McCusker <patmccusker14@gmail.com>
2025-02-24 17:02:45 -07:00
Josh Cummings b6c813c5a2 ClientRegistrations supports hostnames with underscores
Issue gh-15852
2025-02-20 16:54:24 -07:00
Josh Cummings 3d15be1b06 JwtDecoders Supports Hostnames with Underscores
In the process of verifying gh-15852, another issue with URI was discovered.
This commit adds tests to the uri-computing methods and changes them to use
UriComponents instead of URI.

Issue gh-15852
2025-02-20 16:54:24 -07:00
Bodo Graumann 0cd6a19b87 Avoid UriComponentsBuilder.fromUri
Closes gh-15852
2025-02-20 16:54:24 -07:00
Steve Riesenberg 7fc5d50adf Polish gh-16551 2025-02-19 13:53:30 -06:00
Max Batischev 00cd95be76 Add setRedirectStrategy to OidcClientInitiatedServerLogoutSuccessHandler
Closes gh-16556

Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-19 13:53:30 -06:00
Josh Cummings 6793334575 Polish setJwkSelector
Make so that it runs only when selection is needed.
Require the provided selector be non-null.
Add Tests.

Issue gh-16170
2025-02-18 09:14:45 -07:00
douxiaofeng99 e22bc11cc9 Support JWK Selection Strategy
Closes gh-16170

Signed-off-by: douxiaofeng99 <18600127780@163.com>
2025-02-18 09:14:45 -07:00
Joe Grandja 2480d41981 Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Signed-off-by: Joe Grandja <10884212+jgrandja@users.noreply.github.com>
2025-02-11 14:10:23 -05:00
Josh Cummings 11113adf62 Polish Nimbus JWK Source Implementation
Issue gh-16251
2025-02-05 09:28:07 -07:00
Daeho Kwon 7b7abb28bb Remove Deprecated Usages of RemoteJWKSet
Closes gh-16251

Signed-off-by: Daeho Kwon <trewq231@naver.com>
2025-02-05 09:28:07 -07:00
Josh Cummings f9824fd688 Polish Tests
Issue gh-16251
2025-02-05 09:28:07 -07:00
Tran Ngoc Nhan e5ea75f7f4 Implement Serial
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-01-21 18:14:52 -06:00
Rob Winch 004f38639d
Move ClientSettings to ClientRegistration
Initially it was proposed to put ClientSettings as a top level class, but
to be consistent with ProviderDetails, this commit moves ClientSettings to
be an inner class of ClientRegistration

Issue gh-16382


# Conflicts:
#	oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientSettings.java
2025-01-17 17:26:48 -06:00
Rob Winch 4c533569bb
Ensure missing ClientRegistration.clientSettings JSON node works
Issue gh-16382
2025-01-17 17:26:48 -06:00
Rob Winch f9498d3885
PKCE cannot be true and AuthorizationGrantType != AUTHORIZATION_CODE
PKCE is only valid for AuthorizationGrantType.AUTHORIZATION_CODE so the
code should validate this.

Issue gh-16382
2025-01-17 17:26:47 -06:00
Rob Winch ab629cc1ca
Add AuthorizationGrantType.toString()
This adds AuthorizationGrantType.toString() which makes debuging easier.
In particular, it will help when performing unit tests which validate the
AuthorizationGrantType.

Issue gh-16382
2025-01-17 17:26:47 -06:00
Rob Winch b0a4dcb89e
ClientSettings equals, hashCode, toString
Issue gh-16382
2025-01-17 17:26:47 -06:00
Rob Winch 2665a92107
Ensure that ClientSettings cannot be null
This ensures that ClientRegistration.Builder.ClientSettings cannot be null.
This has a slight advantage in terms of null safety to making this check
happen in the build method since the Builder does not have a null field
either.

Issue gh-16382
2025-01-17 17:26:47 -06:00
Rob Winch 0ed7b18f42
DefaultServerOAuth2AuthorizationRequestResolver requireProofKey support
When requireProofKey=true, DefaultServerOAuth2AuthorizationRequestResolver
enables PKCE support.

Issue gh-16382
2025-01-17 17:26:46 -06:00
DingHao 8d3e0844c5
Add ClientRegistration.clientSettings.requireProofKey to Enable PKCE
Closes gh-16382

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-17 17:26:46 -06:00
Tran Ngoc Nhan aced3bcf16 Encode Introspection clientId and clientSecret
Closes gh-15988

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-01-16 16:32:01 -07:00
Max Batischev ed3f3d17b2 Add support customizing redirect URI
Closes gh-14778
2025-01-16 14:14:11 -07:00
Josh Cummings 6019803064
Merge branch '6.4.x' 2025-01-14 18:38:14 -07:00
Josh Cummings 244fd2eb51
Support Serialization in Exceptions
Issue gh-16276
2025-01-14 18:37:53 -07:00
Josh Cummings 0af4cdbf5c
Merge branch '6.4.x' 2025-01-14 17:05:21 -07:00
Josh Cummings 8735368d9e
Don't Support Serialization of Jackson Modules
Issu gh-16276
2025-01-14 17:04:36 -07:00
Steve Riesenberg 6bc6946ad9
Make TokenType constructor public
Closes gh-16086
2024-12-18 16:51:47 -06:00
Steve Riesenberg a7b6c63442
Polish gh-16087 2024-12-18 16:48:25 -06:00
ThomasKasene 9404aaf010
Added a constant for DPOP in OAuth2AccessToken.TokenType
Issue gh-14915
2024-12-18 16:44:38 -06:00
Josh Cummings 018e1ae1a4
Added Serialization Values
Issue gh-16276
2024-12-13 16:41:32 -07:00
Josh Cummings b9911fd522
Add serialVersionUID to Authentication classes
Issue gh-16276
2024-12-13 16:41:32 -07:00
Tran Ngoc Nhan 39cd8d9faf Update copyright headers 2024-12-05 14:52:59 -07:00
Steve Riesenberg 77233daae7
Merge branch '6.3.x'
Closes gh-16139
2024-11-20 15:55:57 -06:00
Steve Riesenberg 4b41f8cb5b
Merge branch '6.2.x' into 6.3.x
Closes gh-16138
2024-11-20 15:54:29 -06:00
Steve Riesenberg 0eb6acde96
Polish gh-16133 2024-11-20 15:50:29 -06:00
Kai Zander 73f3f75712
Always return current ClientRegistration in `loadAuthorizedClient`
This changes `InMemoryOAuth2AuthorizedClientService.loadAuthorizedClient`
(and its reactive counterpart) to always return `OAuth2AuthorizedClient`
instances containing the current `ClientRegistration` as obtained from
the `ClientRegistrationRepository`.

Before this change, the first `ClientRegistration` instance was cached,
with the effect that any changes made in the `ClientRegistrationRepository`
(such as a new client secret) would not have taken effect.

Closes gh-15511
2024-11-20 15:50:29 -06:00
Joe Grandja c2cfe92a02 Merge branch '6.3.x' 2024-11-18 05:16:16 -05:00
Joe Grandja 709103e38c Merge branch '6.2.x' into 6.3.x 2024-11-18 04:45:38 -05:00
Joe Grandja a8c4d6cead Require Locale argument for toLower/toUpperCase usage 2024-11-18 04:22:26 -05:00
Steve Riesenberg ca1f891f25 Polish gh-15937 2024-11-13 15:53:59 -06:00
Davide Colazingari aec5afb6eb Fix assertions in NimbusReactiveJwtDecoderTests 2024-11-13 15:53:59 -06:00
Steve Riesenberg 380e856be5
Merge branch '6.3.x'
Closes gh-16037
2024-11-04 13:34:57 -06:00
Steve Riesenberg b9d5493913
Merge branch '6.2.x' into 6.3.x
Closes gh-16036
2024-11-04 13:34:42 -06:00
Steve Riesenberg 86f3cd6dc7
Polish gh-15940
Closes gh-15885
2024-11-04 13:34:12 -06:00
Hyeongi Jeong 4c6fef82b9
Fix error when Bearer token is requested with empty string
Issue gh-15885
2024-11-04 13:33:58 -06:00
Tran Ngoc Nhan ab93541926 Simplify condition in some methods 2024-10-25 13:42:33 -07:00
Tran Ngoc Nhan e76de931ce Polish Optional usage 2024-10-25 13:42:33 -07:00
Tran Ngoc Nhan ffed4ea1dc Polish diamond usage 2024-10-25 13:42:33 -07:00
Josh Cummings 8a972917fa Deprecate Nimbus(Reactive)OpaqueTokenIntrospector
Issue gh-14245
2024-10-22 21:21:07 -07:00
Steve Riesenberg dab6950231
Move parametersCustomizer
The parametersCustomizer was introduced in 6.4.0-M4 with
DefaultOAuth2TokenRequestParametersConverter. However, it cannot be
applied to all parameters and so does not fully solve gh-11298.

This commit moves the customizer to the abstract class so it can be
applied to all parameters.

Closes gh-15939
2024-10-18 12:22:09 -05:00
Tran Ngoc Nhan 31f8caec5f Polish diamond operator usage 2024-10-14 11:51:35 -07:00
Giovanni Lovato a3fd551fb5 Add ClientRegistrations.fromOidcConfiguration method
ClientRegistrations now provides the fromOidcConfiguration
method to create a ClientRegistration.Builder from a map
representation of an OpenID Provider Configuration Response.

This is useful when the OpenID Provider Configuration is not
available at a well-known location, or if custom validation
is needed for the issuer location (e.g. if the issuer is only
reachable via a back-channel URI that is different from the
issuer value in the configuration).

Fixes: gh-14633
2024-10-02 15:11:01 -05:00
Steve Riesenberg f5991ae176 Allow access token request parameters to override defaults
Closes gh-11298
2024-10-02 12:05:42 -05:00
Steve Riesenberg 9ba2435cb2
Support refresh token for Token Exchange
Closes gh-15534
2024-09-27 15:57:57 -05:00
Steve Riesenberg e11c188122
Customize the strategy for resolving the principal
Closes gh-15826
2024-09-27 15:39:56 -05:00
Thomas Darimont b06c40d9ef Add ExpressionJwtGrantedAuthoritiesConverter to extract authorities with an expression
This helps to reduce custom code necessary to extract roles from deeply
nested claims.

Closes #15201

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
2024-09-23 16:59:59 -07:00
Steve Riesenberg 1a97d07079
Merge branch '6.2.x' into 6.3.x
Closes gh-15829
2024-09-19 16:23:08 -05:00
Steve Riesenberg 551c483ee6
Merge branch '5.8.x' into 6.2.x
Closes gh-15828
2024-09-19 16:22:37 -05:00
Steve Riesenberg 7b7a3044cf
Polish gh-15533 2024-09-19 16:13:03 -05:00
陈圳佳 8a791028b1
Fix array values of additionalParameters
Closes gh-15468
2024-09-19 16:10:00 -05:00
Steve Riesenberg 42d9f146d2 Polish gh-15533 2024-09-19 16:05:39 -05:00
陈圳佳 24dbc5de53 Fix array values of additionalParameters
Closes gh-15468
2024-09-19 16:05:39 -05:00
Steve Riesenberg c1a303bc92
Add tests for overriding parameters
Issue gh-15298
Issue gh-11298
2024-09-19 13:01:09 -05:00
Steve Riesenberg 5d8cf6a8bc
Polish gh-13588 2024-09-19 12:08:48 -05:00
Tran Ngoc Nhan 2c9c309d7f Provide Casting for ReactiveJwtDecoder
Closes gh-15773
2024-09-17 13:54:35 -07:00
Steve Riesenberg 63f018eb18
Update tests using deprecated classes
Issue gh-15737
2024-09-10 15:10:42 -05:00
Steve Riesenberg 7490a8162b
Deprecate default OAuth2AccessTokenResponseClients
Closes gh-15737
2024-09-10 15:10:41 -05:00
Steve Riesenberg 2cead9b73f
Add RestClient implementations
Issue gh-15298
2024-09-10 15:10:41 -05:00
Marcus Hert Da Coregio 912062d307 Merge branch '6.2.x' into 6.3.x 2024-08-19 09:11:10 -03:00
Daniel Garnier-Moiroux 79fb0113c8 Bump io-spring-javaformat from 0.0.42 to 0.0.43
Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

---
Manual updates:
- Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST
  be used together

Signed-off-by: dependabot[bot] <support@github.com>
2024-08-19 09:11:05 -03:00
Daniel Garnier-Moiroux 2caf1fb6b4 Bump io-spring-javaformat from 0.0.42 to 0.0.43
Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

---
Manual updates:
- Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST
  be used together

Signed-off-by: dependabot[bot] <support@github.com>
2024-08-19 09:08:24 -03:00
Steve Riesenberg e3c19ba86c Add RestClient interceptor
Closes gh-13588
2024-08-16 17:15:18 -05:00
Josh Cummings b6ce40980d
Merge branch '6.3.x' 2024-07-22 15:34:34 -06:00
Josh Cummings d887c7882d
Merge branch '6.2.x' into 6.3.x
Closes gh-15460
2024-07-22 15:34:18 -06:00
Josh Cummings 4406462346
Merge branch '5.8.x' into 6.2.x
Closes gh-15459
2024-07-22 15:34:08 -06:00
Josh Cummings 5c1a108b8b
Remove Stray JavaDoc Statement
As of the 5.2 release, a separate registrar bean was no longer necessary

Closes gh-15425
2024-07-22 15:33:57 -06:00
Josh Cummings df76537470 Update Formatting
Issue gh-15338
2024-07-18 16:39:30 -07:00