Introduce Reactive OAuth2AuthorizedClient Manager/Provider by jgrandja · Pull Request #7116 · spring-projects/spring-security

jgrandja · 2019-07-17T21:29:05Z

This PR addresses the reactive implementation of #6811.

jgrandja · 2019-07-25T21:23:29Z

@rwinch @jzheaux I just merged #6845 and rebased this PR off master. As an FYI, all the review feedback from #6845 has also been applied to this PR. I believe this is close to merging. It would be ideal if we can merge this for M4 as well. Feel free to add polish in order to get this merged while I am away. Thank you.

Fixes spring-projectsgh-7116

robotmrv · 2019-08-03T15:55:58Z

...mework/security/oauth2/client/endpoint/WebClientReactiveRefreshTokenTokenResponseClient.java

+							OAuth2Error oauth2Error = new OAuth2Error(INVALID_TOKEN_RESPONSE_ERROR_CODE,
+									"An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: " +
+											"HTTP Status Code " + response.rawStatusCode(), null);
+							throw new OAuth2AuthorizationException(oauth2Error);


possible resource leak
from org.springframework.web.reactive.function.client.WebClient.RequestHeadersSpec#exchange javadoc

NOTE: You must always use one of the body or entity methods of the response to ensure resources are released. See ClientResponse for more details.

@robotmrv I'm not sure I'm following? The ClientResponse.body method is used for a successful response...

response.body(oauth2AccessTokenResponse())

The ClientResponse.body method is used for a successful response...

exactly
it is requirement to consume body in any case
there are several issues related to this problem (e.g. spring-projects/spring-framework#22005 (comment) )
see last paragraph from reference guide https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html#webflux-client-exchange
So my proposal is just to use in case of error

return clientResponse.bodyToMono(Void.class) .then(Mono.error(new OAuth2AuthorizationException(oauth2Error)));

Thanks for catching this @robotmrv. I'll update similar to your proposal.

...mework/security/oauth2/client/endpoint/WebClientReactiveRefreshTokenTokenResponseClient.java

rwinch

Thanks for the PR @jgrandja! I have provided feedback inline

...ramework/security/oauth2/client/AuthorizationCodeReactiveOAuth2AuthorizedClientProvider.java

rwinch · 2019-08-19T18:56:27Z

...ramework/security/oauth2/client/ClientCredentialsReactiveOAuth2AuthorizedClientProvider.java

+	}
+
+	private boolean hasTokenExpired(AbstractOAuth2Token token) {
+		return token.getExpiresAt().isBefore(Instant.now().minus(this.clockSkew));


We should probably allow injecting a Clock vs using Instant.now. This comment should be applied globally throughout this PR. Additionally, we should do the same on the imperative side

This enhancement is tracked in this ticket #7114

...th2/client/web/reactive/result/method/annotation/OAuth2AuthorizedClientArgumentResolver.java

jzheaux

@jgrandja looks good, just pending the one comment from @robotmrv

robotmrv · 2019-08-20T20:48:28Z

...mework/security/oauth2/client/endpoint/WebClientReactiveRefreshTokenTokenResponseClient.java

+					.body(tokenRequestBody(refreshTokenGrantRequest))
+					.exchange()
+					.flatMap(response -> {
+						if (!response.statusCode().is2xxSuccessful()) {


It is possible to catch IllegalArgumentException for non-standard status code
Not sure about real probability of the problem but
there are several related issues
spring-cloud/spring-cloud-sleuth#1382
spring-projects/spring-framework#23367
spring-projects/spring-framework#23366

Thanks @robotmrv You are right we need to ensure we don't cause a leak by calling statusCode() when the status is unknown. Instead we should do something like:

HttpStatus status = HttpStatus.resolve(response.rawStatusCode()); if (status == null || !status.is2xxSuccessful()) {

@jgrandja I see that this case was not covered in your final commit.
Just check that You did not miss it.

I did forget! Thanks for letting me know @robotmrv :) I added this polish f0515a0

Fixes spring-projectsgh-7116

jgrandja requested review from jzheaux and rwinch July 17, 2019 21:29

jgrandja added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement labels Jul 17, 2019

jgrandja self-assigned this Jul 17, 2019

jgrandja mentioned this pull request Jul 19, 2019

Add support for Resource Owner Password Credentials grant #7013

Closed

jgrandja force-pushed the gh-6811-webclient-ext-reuse-reactive branch 2 times, most recently from 3d0fd4d to 1e7e4bd Compare July 25, 2019 20:34

jgrandja changed the title ~~Introduce ReactiveOAuth2AuthorizedClientProvider~~ Introduce Reactive OAuth2AuthorizedClient Manager/Provider Jul 25, 2019

jgrandja added this to the 5.2.0.M4 milestone Jul 25, 2019

jgrandja mentioned this pull request Jul 26, 2019

Allow configurable Clock in OAuth2AuthorizedClientProvider impls #7114

Closed

Introduce Reactive OAuth2AuthorizedClient Manager/Provider

d5e4325

Fixes spring-projectsgh-7116

jgrandja force-pushed the gh-6811-webclient-ext-reuse-reactive branch from 1e7e4bd to d5e4325 Compare July 26, 2019 18:50

robotmrv reviewed Aug 3, 2019

View reviewed changes

...mework/security/oauth2/client/endpoint/WebClientReactiveRefreshTokenTokenResponseClient.java Show resolved Hide resolved

jzheaux modified the milestones: 5.2.0.M4, 5.2.0.RC1 Aug 5, 2019

rwinch requested changes Aug 19, 2019

View reviewed changes

jgrandja added 2 commits August 20, 2019 08:50

Update javadoc and remove @nullable

1fe9399

Remove use of Optional

5775257

rwinch approved these changes Aug 20, 2019

View reviewed changes

jzheaux approved these changes Aug 20, 2019

View reviewed changes

robotmrv reviewed Aug 20, 2019

View reviewed changes

jgrandja closed this in 46756d2 Aug 21, 2019

jgrandja mentioned this pull request Aug 21, 2019

Align code in oauth2-client extensions for WebClient #6811

Closed

21 tasks

jgrandja deleted the gh-6811-webclient-ext-reuse-reactive branch August 21, 2019 18:35

jgrandja added a commit that referenced this pull request Aug 22, 2019

Polish #7116

f0515a0

kostya05983 pushed a commit to kostya05983/spring-security that referenced this pull request Aug 26, 2019

Introduce Reactive OAuth2AuthorizedClient Manager/Provider

3bb9aa8

Fixes spring-projectsgh-7116

kostya05983 pushed a commit to kostya05983/spring-security that referenced this pull request Aug 26, 2019

Polish spring-projects#7116

703833d

jgrandja mentioned this pull request Sep 4, 2019

Remove unused OAuth2AuthorizedClientResolver #7357

Closed

Conversation

jgrandja commented Jul 17, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jgrandja commented Jul 25, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rwinch left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jzheaux left a comment

Choose a reason for hiding this comment

Uh oh!

robotmrv Aug 20, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rwinch Aug 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jgrandja commented Jul 17, 2019 •

edited

Loading

robotmrv Aug 20, 2019 •

edited

Loading

rwinch Aug 21, 2019 •

edited

Loading