Browse Source
Adds configurable authentication converter for resource-servers with token introspection (something very similar to what JwtAuthenticationConverter does for resource-servers with JWT decoder). The new (Reactive)OpaqueTokenAuthenticationConverter is given responsibility for converting successful token introspection result into an Authentication instance (which is currently done by a private methods of OpaqueTokenAuthenticationProvider and OpaqueTokenReactiveAuthenticationManager). The default (Reactive)OpaqueTokenAuthenticationConverter, behave the same as current private convert(OAuth2AuthenticatedPrincipal principal, String token) methods: map authorities from scope attribute and build a BearerTokenAuthentication. Closes gh-11661pull/11882/head
ch4mpy
3 years ago
committed by
Steve Riesenberg
16 changed files with 385 additions and 48 deletions
@ -0,0 +1,37 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<!-- |
||||||
|
~ Copyright 2002-2020 the original author or authors. |
||||||
|
~ |
||||||
|
~ Licensed under the Apache License, Version 2.0 (the "License"); |
||||||
|
~ you may not use this file except in compliance with the License. |
||||||
|
~ You may obtain a copy of the License at |
||||||
|
~ |
||||||
|
~ https://www.apache.org/licenses/LICENSE-2.0 |
||||||
|
~ |
||||||
|
~ Unless required by applicable law or agreed to in writing, software |
||||||
|
~ distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
~ See the License for the specific language governing permissions and |
||||||
|
~ limitations under the License. |
||||||
|
--> |
||||||
|
|
||||||
|
<b:beans xmlns:b="http://www.springframework.org/schema/beans" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xmlns="http://www.springframework.org/schema/security" |
||||||
|
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd |
||||||
|
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd"> |
||||||
|
|
||||||
|
<b:bean name="authentication-converter" |
||||||
|
class="org.springframework.security.config.http.OAuth2ResourceServerBeanDefinitionParserTests$TestOpaqueTokenAuthenticationConverter"> |
||||||
|
</b:bean> |
||||||
|
|
||||||
|
<http> |
||||||
|
<intercept-url pattern="/requires-read-scope" access="hasAuthority('SCOPE_message:read')"/> |
||||||
|
<intercept-url pattern="/**" access="authenticated"/> |
||||||
|
<oauth2-resource-server> |
||||||
|
<opaque-token introspector-ref="introspector" authentication-converter-ref="authentication-converter"/> |
||||||
|
</oauth2-resource-server> |
||||||
|
</http> |
||||||
|
|
||||||
|
<b:import resource="userservice.xml"/> |
||||||
|
</b:beans> |
||||||
@ -0,0 +1,33 @@ |
|||||||
|
/* |
||||||
|
* Copyright 2002-2022 the original author or authors. |
||||||
|
* |
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||||
|
* you may not use this file except in compliance with the License. |
||||||
|
* You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
|
||||||
|
package org.springframework.security.oauth2.server.resource.introspection; |
||||||
|
|
||||||
|
import org.springframework.security.core.Authentication; |
||||||
|
import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal; |
||||||
|
|
||||||
|
/** |
||||||
|
* Turn successful introspection result into an Authentication instance |
||||||
|
* |
||||||
|
* @author Jerome Wacongne <ch4mp@c4-soft.com> |
||||||
|
* @since 5.8 |
||||||
|
*/ |
||||||
|
@FunctionalInterface |
||||||
|
public interface OpaqueTokenAuthenticationConverter { |
||||||
|
|
||||||
|
Authentication convert(String introspectedToken, OAuth2AuthenticatedPrincipal authenticatedPrincipal); |
||||||
|
|
||||||
|
} |
||||||
@ -0,0 +1,35 @@ |
|||||||
|
/* |
||||||
|
* Copyright 2002-2021 the original author or authors. |
||||||
|
* |
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||||
|
* you may not use this file except in compliance with the License. |
||||||
|
* You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
|
||||||
|
package org.springframework.security.oauth2.server.resource.introspection; |
||||||
|
|
||||||
|
import reactor.core.publisher.Mono; |
||||||
|
|
||||||
|
import org.springframework.security.core.Authentication; |
||||||
|
import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal; |
||||||
|
|
||||||
|
/** |
||||||
|
* Turn successful introspection result into an Authentication instance |
||||||
|
* |
||||||
|
* @author Jerome Wacongne <ch4mp@c4-soft.com> |
||||||
|
* @since 5.8 |
||||||
|
*/ |
||||||
|
@FunctionalInterface |
||||||
|
public interface ReactiveOpaqueTokenAuthenticationConverter { |
||||||
|
|
||||||
|
Mono<Authentication> convert(String introspectedToken, OAuth2AuthenticatedPrincipal authenticatedPrincipal); |
||||||
|
|
||||||
|
} |
||||||
Loading…
Reference in new issue