Skip to content

Commit 1929e3a

Browse files
ovidiupopa07jgrandja
ovidiupopa07
authored and
jgrandja
committed
JdbcRegisteredClientRepository hashes client secret on save
Closes gh-378
1 parent 7546d18 commit 1929e3a

File tree

9 files changed

+107
-21
lines changed

9 files changed

+107
-21
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/JdbcRegisteredClientRepository.java‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@
3636
import org.springframework.jdbc.core.PreparedStatementSetter;
3737
import org.springframework.jdbc.core.RowMapper;
3838
import org.springframework.jdbc.core.SqlParameterValue;
39+
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
40+
import org.springframework.security.crypto.password.PasswordEncoder;
3941
import org.springframework.security.jackson2.SecurityJackson2Modules;
4042
import org.springframework.security.oauth2.core.AuthorizationGrantType;
4143
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
@@ -291,6 +293,7 @@ private static ClientAuthenticationMethod resolveClientAuthenticationMethod(Stri
291293
*/
292294
public static class RegisteredClientParametersMapper implements Function<RegisteredClient, List<SqlParameterValue>> {
293295
private ObjectMapper objectMapper = new ObjectMapper();
296+
private PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
294297

295298
public RegisteredClientParametersMapper() {
296299
ClassLoader classLoader = JdbcRegisteredClientRepository.class.getClassLoader();
@@ -319,7 +322,7 @@ public List<SqlParameterValue> apply(RegisteredClient registeredClient) {
319322
new SqlParameterValue(Types.VARCHAR, registeredClient.getId()),
320323
new SqlParameterValue(Types.VARCHAR, registeredClient.getClientId()),
321324
new SqlParameterValue(Types.TIMESTAMP, clientIdIssuedAt),
322-
new SqlParameterValue(Types.VARCHAR, registeredClient.getClientSecret()),
325+
new SqlParameterValue(Types.VARCHAR, encode(registeredClient.getClientSecret())),
323326
new SqlParameterValue(Types.TIMESTAMP, clientSecretExpiresAt),
324327
new SqlParameterValue(Types.VARCHAR, registeredClient.getClientName()),
325328
new SqlParameterValue(Types.VARCHAR, StringUtils.collectionToCommaDelimitedString(clientAuthenticationMethods)),
@@ -335,6 +338,12 @@ public final void setObjectMapper(ObjectMapper objectMapper) {
335338
this.objectMapper = objectMapper;
336339
}
337340

341+
342+
public final void setPasswordEncoder(PasswordEncoder passwordEncoder) {
343+
Assert.notNull(passwordEncoder, "passwordEncoder cannot be null");
344+
this.passwordEncoder = passwordEncoder;
345+
}
346+
338347
protected final ObjectMapper getObjectMapper() {
339348
return this.objectMapper;
340349
}
@@ -347,6 +356,13 @@ private String writeMap(Map<String, Object> data) {
347356
}
348357
}
349358

359+
private String encode(String value) {
360+
if (value != null) {
361+
return this.passwordEncoder.encode(value);
362+
}
363+
return null;
364+
}
365+
350366
}
351367

352368
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationCodeGrantTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
8484
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationToken;
8585
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
86+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
8687
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
8788
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
8889
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -582,8 +583,12 @@ OAuth2AuthorizationConsentService authorizationConsentService(JdbcOperations jdb
582583
}
583584

584585
@Bean
585-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
586-
return new JdbcRegisteredClientRepository(jdbcOperations);
586+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
587+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
588+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
589+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
590+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
591+
return jdbcRegisteredClientRepository;
587592
}
588593

589594
@Bean

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2ClientCredentialsGrantTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@
6868
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
6969
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientCredentialsAuthenticationToken;
7070
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
71+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
7172
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
7273
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
7374
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -282,8 +283,12 @@ OAuth2AuthorizationService authorizationService(JdbcOperations jdbcOperations, R
282283
}
283284

284285
@Bean
285-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
286-
return new JdbcRegisteredClientRepository(jdbcOperations);
286+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
287+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
288+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
289+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
290+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
291+
return jdbcRegisteredClientRepository;
287292
}
288293

289294
@Bean

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2RefreshTokenGrantTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@
6868
import org.springframework.security.oauth2.server.authorization.OAuth2TokenCustomizer;
6969
import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
7070
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
71+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
7172
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
7273
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
7374
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -207,8 +208,12 @@ OAuth2AuthorizationService authorizationService(JdbcOperations jdbcOperations, R
207208
}
208209

209210
@Bean
210-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
211-
return new JdbcRegisteredClientRepository(jdbcOperations);
211+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
212+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
213+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
214+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
215+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
216+
return jdbcRegisteredClientRepository;
212217
}
213218

214219
@Bean

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenIntrospectionTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
6363
import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
6464
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
65+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
6566
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
6667
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
6768
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -244,8 +245,12 @@ OAuth2AuthorizationService authorizationService(JdbcOperations jdbcOperations, R
244245
}
245246

246247
@Bean
247-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
248-
return new JdbcRegisteredClientRepository(jdbcOperations);
248+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
249+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
250+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
251+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
252+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
253+
return jdbcRegisteredClientRepository;
249254
}
250255

251256
@Bean

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2TokenRevocationTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
5555
import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
5656
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
57+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
5758
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
5859
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
5960
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -207,8 +208,12 @@ OAuth2AuthorizationService authorizationService(JdbcOperations jdbcOperations, R
207208
}
208209

209210
@Bean
210-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
211-
return new JdbcRegisteredClientRepository(jdbcOperations);
211+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
212+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
213+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
214+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
215+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
216+
return jdbcRegisteredClientRepository;
212217
}
213218

214219
@Bean

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcClientRegistrationTests.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@
6060
import org.springframework.security.oauth2.jose.TestJwks;
6161
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
6262
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
63+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
6364
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
6465
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
6566
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -226,9 +227,12 @@ private static OidcClientRegistration readClientRegistrationResponse(MockHttpSer
226227
static class AuthorizationServerConfiguration {
227228

228229
@Bean
229-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
230+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
230231
RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
232+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
233+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
231234
JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
235+
registeredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
232236
registeredClientRepository.save(registeredClient);
233237
return registeredClientRepository;
234238
}

‎oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcTests.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@
7373
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
7474
import org.springframework.security.oauth2.server.authorization.OAuth2TokenCustomizer;
7575
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
76+
import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
7677
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
7778
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
7879
import org.springframework.security.oauth2.server.authorization.client.TestRegisteredClients;
@@ -275,8 +276,12 @@ OAuth2AuthorizationService authorizationService(JdbcOperations jdbcOperations, R
275276
}
276277

277278
@Bean
278-
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
279-
return new JdbcRegisteredClientRepository(jdbcOperations);
279+
RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations, PasswordEncoder passwordEncoder) {
280+
JdbcRegisteredClientRepository jdbcRegisteredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
281+
RegisteredClientParametersMapper registeredClientParametersMapper = new RegisteredClientParametersMapper();
282+
registeredClientParametersMapper.setPasswordEncoder(passwordEncoder);
283+
jdbcRegisteredClientRepository.setRegisteredClientParametersMapper(registeredClientParametersMapper);
284+
return jdbcRegisteredClientRepository;
280285
}
281286

282287
@Bean

0 commit comments

Comments
 (0)