Skip to content

Commit b581bb7

Browse files
nickbr23jgrandja
nickbr23
authored and
jgrandja
committed
Add new configuration options for OAuth2LoginSpec
Fixes gh-5598
1 parent 976e763 commit b581bb7

File tree

2 files changed

+69
-8
lines changed

2 files changed

+69
-8
lines changed

‎config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java‎

Lines changed: 50 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -53,8 +53,10 @@
5353
import org.springframework.security.oauth2.client.web.server.OAuth2AuthorizationCodeGrantWebFilter;
5454
import org.springframework.security.oauth2.client.web.server.OAuth2AuthorizationRequestRedirectWebFilter;
5555
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationCodeAuthenticationTokenConverter;
56+
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
5657
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
5758
import org.springframework.security.oauth2.client.web.server.authentication.OAuth2LoginAuthenticationWebFilter;
59+
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
5860
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
5961
import org.springframework.security.oauth2.core.user.OAuth2User;
6062
import org.springframework.security.oauth2.jwt.Jwt;
@@ -588,6 +590,10 @@ public class OAuth2LoginSpec {
588590

589591
private ServerAuthenticationConverter authenticationConverter;
590592

593+
private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver;
594+
595+
private ServerWebExchangeMatcher authenticationMatcher;
596+
591597
/**
592598
* Configures the {@link ReactiveAuthenticationManager} to use. The default is
593599
* {@link OAuth2AuthorizationCodeReactiveAuthenticationManager}
@@ -664,6 +670,37 @@ public OAuth2LoginSpec authorizedClientRepository(ServerOAuth2AuthorizedClientRe
664670
return this;
665671
}
666672

673+
/**
674+
* Sets the resolver used for resolving {@link OAuth2AuthorizationRequest}'s.
675+
*
676+
* @since 5.2
677+
* @param authorizationRequestResolver the resolver used for resolving {@link OAuth2AuthorizationRequest}'s
678+
* @return the {@link OAuth2LoginSpec} for further configuration
679+
*/
680+
public OAuth2LoginSpec authorizationRequestResolver(ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver) {
681+
this.authorizationRequestResolver = authorizationRequestResolver;
682+
return this;
683+
}
684+
685+
/**
686+
* Sets the {@link ServerWebExchangeMatcher matcher} used for determining if the request is an authentication request.
687+
*
688+
* @since 5.2
689+
* @param authenticationMatcher the {@link ServerWebExchangeMatcher matcher} used for determining if the request is an authentication request
690+
* @return the {@link OAuth2LoginSpec} for further configuration
691+
*/
692+
public OAuth2LoginSpec authenticationMatcher(ServerWebExchangeMatcher authenticationMatcher) {
693+
this.authenticationMatcher = authenticationMatcher;
694+
return this;
695+
}
696+
697+
private ServerWebExchangeMatcher getAuthenticationMatcher() {
698+
if (this.authenticationMatcher == null) {
699+
this.authenticationMatcher = createAttemptAuthenticationRequestMatcher();
700+
}
701+
return this.authenticationMatcher;
702+
}
703+
667704
/**
668705
* Allows method chaining to continue configuring the {@link ServerHttpSecurity}
669706
* @return the {@link ServerHttpSecurity} to continue configuring
@@ -676,12 +713,12 @@ public ServerHttpSecurity and() {
676713
protected void configure(ServerHttpSecurity http) {
677714
ReactiveClientRegistrationRepository clientRegistrationRepository = getClientRegistrationRepository();
678715
ServerOAuth2AuthorizedClientRepository authorizedClientRepository = getAuthorizedClientRepository();
679-
OAuth2AuthorizationRequestRedirectWebFilter oauthRedirectFilter = new OAuth2AuthorizationRequestRedirectWebFilter(clientRegistrationRepository);
716+
OAuth2AuthorizationRequestRedirectWebFilter oauthRedirectFilter = getRedirectWebFilter();
680717

681718
ReactiveAuthenticationManager manager = getAuthenticationManager();
682719

683720
AuthenticationWebFilter authenticationFilter = new OAuth2LoginAuthenticationWebFilter(manager, authorizedClientRepository);
684-
authenticationFilter.setRequiresAuthenticationMatcher(createAttemptAuthenticationRequestMatcher());
721+
authenticationFilter.setRequiresAuthenticationMatcher(getAuthenticationMatcher());
685722
authenticationFilter.setServerAuthenticationConverter(getAuthenticationConverter(clientRegistrationRepository));
686723
RedirectServerAuthenticationSuccessHandler redirectHandler = new RedirectServerAuthenticationSuccessHandler();
687724

@@ -756,6 +793,16 @@ private ReactiveClientRegistrationRepository getClientRegistrationRepository() {
756793
return this.clientRegistrationRepository;
757794
}
758795

796+
private OAuth2AuthorizationRequestRedirectWebFilter getRedirectWebFilter() {
797+
OAuth2AuthorizationRequestRedirectWebFilter oauthRedirectFilter;
798+
if (this.authorizationRequestResolver == null) {
799+
oauthRedirectFilter = new OAuth2AuthorizationRequestRedirectWebFilter(getClientRegistrationRepository());
800+
} else {
801+
oauthRedirectFilter = new OAuth2AuthorizationRequestRedirectWebFilter(this.authorizationRequestResolver);
802+
}
803+
return oauthRedirectFilter;
804+
}
805+
759806
private ServerOAuth2AuthorizedClientRepository getAuthorizedClientRepository() {
760807
ServerOAuth2AuthorizedClientRepository result = this.authorizedClientRepository;
761808
if (result == null) {

‎config/src/test/java/org/springframework/security/config/web/server/OAuth2LoginTests.java‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2019 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -37,6 +37,7 @@
3737
import org.springframework.security.oauth2.client.registration.ClientRegistration;
3838
import org.springframework.security.oauth2.client.registration.InMemoryReactiveClientRegistrationRepository;
3939
import org.springframework.security.oauth2.client.userinfo.ReactiveOAuth2UserService;
40+
import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
4041
import org.springframework.security.oauth2.core.OAuth2AccessToken;
4142
import org.springframework.security.oauth2.core.TestOAuth2AccessTokens;
4243
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
@@ -59,6 +60,7 @@
5960
import org.springframework.security.web.server.SecurityWebFilterChain;
6061
import org.springframework.security.web.server.WebFilterChainProxy;
6162
import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
63+
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
6264
import org.springframework.test.web.reactive.server.WebTestClient;
6365
import org.springframework.web.server.ServerWebExchange;
6466
import org.springframework.web.server.WebFilter;
@@ -100,7 +102,7 @@ public class OAuth2LoginTests {
100102

101103
@Test
102104
public void defaultLoginPageWithMultipleClientRegistrationsThenLinks() {
103-
this.spring.register(OAuth2LoginWithMulitpleClientRegistrations.class).autowire();
105+
this.spring.register(OAuth2LoginWithMultipleClientRegistrations.class).autowire();
104106

105107
WebTestClient webTestClient = WebTestClientBuilder
106108
.bindToWebFilters(this.springSecurity)
@@ -120,7 +122,7 @@ public void defaultLoginPageWithMultipleClientRegistrationsThenLinks() {
120122
}
121123

122124
@EnableWebFluxSecurity
123-
static class OAuth2LoginWithMulitpleClientRegistrations {
125+
static class OAuth2LoginWithMultipleClientRegistrations {
124126
@Bean
125127
InMemoryReactiveClientRegistrationRepository clientRegistrationRepository() {
126128
return new InMemoryReactiveClientRegistrationRepository(github, google);
@@ -165,6 +167,8 @@ public void oauth2LoginWhenCustomObjectsThenUsed() {
165167
.getBean(OAuth2LoginMockAuthenticationManagerConfig.class);
166168
ServerAuthenticationConverter converter = config.authenticationConverter;
167169
ReactiveAuthenticationManager manager = config.manager;
170+
ServerWebExchangeMatcher matcher = config.matcher;
171+
ServerOAuth2AuthorizationRequestResolver resolver = config.resolver;
168172

169173
OAuth2AuthorizationExchange exchange = TestOAuth2AuthorizationExchanges.success();
170174
OAuth2User user = TestOAuth2Users.create();
@@ -174,6 +178,8 @@ public void oauth2LoginWhenCustomObjectsThenUsed() {
174178

175179
when(converter.convert(any())).thenReturn(Mono.just(new TestingAuthenticationToken("a", "b", "c")));
176180
when(manager.authenticate(any())).thenReturn(Mono.just(result));
181+
when(matcher.matches(any())).thenReturn(ServerWebExchangeMatcher.MatchResult.match());
182+
when(resolver.resolve(any())).thenReturn(Mono.empty());
177183

178184
webTestClient.get()
179185
.uri("/login/oauth2/code/github")
@@ -182,6 +188,8 @@ public void oauth2LoginWhenCustomObjectsThenUsed() {
182188

183189
verify(converter).convert(any());
184190
verify(manager).authenticate(any());
191+
verify(matcher).matches(any());
192+
verify(resolver).resolve(any());
185193
}
186194

187195
@Configuration
@@ -190,6 +198,10 @@ static class OAuth2LoginMockAuthenticationManagerConfig {
190198

191199
ServerAuthenticationConverter authenticationConverter = mock(ServerAuthenticationConverter.class);
192200

201+
ServerWebExchangeMatcher matcher = mock(ServerWebExchangeMatcher.class);
202+
203+
ServerOAuth2AuthorizationRequestResolver resolver = mock(ServerOAuth2AuthorizationRequestResolver.class);
204+
193205
@Bean
194206
public SecurityWebFilterChain springSecurityFilter(ServerHttpSecurity http) {
195207
http
@@ -198,14 +210,16 @@ public SecurityWebFilterChain springSecurityFilter(ServerHttpSecurity http) {
198210
.and()
199211
.oauth2Login()
200212
.authenticationConverter(authenticationConverter)
201-
.authenticationManager(manager);
213+
.authenticationManager(manager)
214+
.authenticationMatcher(matcher)
215+
.authorizationRequestResolver(resolver);
202216
return http.build();
203217
}
204218
}
205219

206220
@Test
207221
public void oauth2LoginWhenCustomJwtDecoderFactoryThenUsed() {
208-
this.spring.register(OAuth2LoginWithMulitpleClientRegistrations.class,
222+
this.spring.register(OAuth2LoginWithMultipleClientRegistrations.class,
209223
OAuth2LoginWithJwtDecoderFactoryBeanConfig.class).autowire();
210224

211225
WebTestClient webTestClient = WebTestClientBuilder

0 commit comments

Comments
 (0)