Skip to content

Commit 2f059f2

Browse files
alek-sysalek-sys
committed
Add client_credentials grant type support
1 parent 8891164 commit 2f059f2

File tree

12 files changed

+743
-5
lines changed

12 files changed

+743
-5
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
2727
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationProvider;
2828
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationProvider;
29+
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientCredentialsAuthenticationProvider;
2930
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
3031
import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationEndpointFilter;
3132
import org.springframework.security.oauth2.server.authorization.web.OAuth2ClientAuthenticationFilter;
@@ -88,7 +89,12 @@ public void init(B builder) {
8889
new OAuth2AuthorizationCodeAuthenticationProvider(
8990
getRegisteredClientRepository(builder),
9091
getAuthorizationService(builder));
92+
93+
OAuth2ClientCredentialsAuthenticationProvider clientCredentialsAuthenticationProvider
94+
= new OAuth2ClientCredentialsAuthenticationProvider();
95+
9196
builder.authenticationProvider(postProcess(authorizationCodeAuthenticationProvider));
97+
builder.authenticationProvider(postProcess(clientCredentialsAuthenticationProvider));
9298
}
9399

94100
@Override

‎core/spring-authorization-server-core.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ dependencies {
1717
testCompile 'org.assertj:assertj-core'
1818
testCompile 'org.mockito:mockito-core'
1919
testCompile 'com.squareup.okhttp3:mockwebserver'
20+
testCompile 'com.jayway.jsonpath:json-path'
2021

2122
provided 'javax.servlet:javax.servlet-api'
2223
}

‎core/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationProvider.java‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
/*
2+
* Copyright 2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.security.oauth2.server.authorization.authentication;
17+
18+
import java.time.Instant;
19+
import java.time.temporal.ChronoUnit;
20+
import java.util.Base64;
21+
import java.util.Set;
22+
23+
import org.springframework.security.authentication.AuthenticationProvider;
24+
import org.springframework.security.core.Authentication;
25+
import org.springframework.security.core.AuthenticationException;
26+
import org.springframework.security.crypto.keygen.Base64StringKeyGenerator;
27+
import org.springframework.security.crypto.keygen.StringKeyGenerator;
28+
import org.springframework.security.oauth2.core.OAuth2AccessToken;
29+
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
30+
import org.springframework.security.oauth2.core.OAuth2Error;
31+
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
32+
33+
/**
34+
* An {@link AuthenticationProvider} implementation for the OAuth 2.0 Client Credentials Grant.
35+
*
36+
* @author Alexey Nesterov
37+
* @since 0.0.1
38+
* @see OAuth2ClientCredentialsAuthenticationToken
39+
* @see <a target="_blank" href="https://tools.ietf.org/html/rfc6749#section-4.4">Section 4.4 Client Credentials Grant</a>
40+
* @see <a target="_blank" href="https://tools.ietf.org/html/rfc6749#section-4.4.2">Section 4.4.2 Access Token Request</a>
41+
*/
42+
43+
public class OAuth2ClientCredentialsAuthenticationProvider implements AuthenticationProvider {
44+
45+
private final StringKeyGenerator accessTokenGenerator = new Base64StringKeyGenerator(Base64.getUrlEncoder());
46+
47+
@Override
48+
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
49+
OAuth2ClientCredentialsAuthenticationToken clientCredentialsAuthenticationToken =
50+
(OAuth2ClientCredentialsAuthenticationToken) authentication;
51+
52+
OAuth2ClientAuthenticationToken clientPrincipal = null;
53+
if (OAuth2ClientAuthenticationToken.class.isAssignableFrom(clientCredentialsAuthenticationToken.getPrincipal().getClass())) {
54+
clientPrincipal = (OAuth2ClientAuthenticationToken) clientCredentialsAuthenticationToken.getPrincipal();
55+
}
56+
57+
if (clientPrincipal == null || !clientPrincipal.isAuthenticated()) {
58+
throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_CLIENT));
59+
}
60+
61+
Set<String> clientScopes = clientPrincipal.getRegisteredClient().getScopes();
62+
Set<String> requestedScopes = clientCredentialsAuthenticationToken.getScopes();
63+
if (!clientScopes.containsAll(requestedScopes)) {
64+
throw new OAuth2AuthenticationException(new OAuth2Error(OAuth2ErrorCodes.INVALID_SCOPE));
65+
}
66+
67+
if (requestedScopes == null || requestedScopes.isEmpty()) {
68+
requestedScopes = clientScopes;
69+
}
70+
71+
String tokenValue = this.accessTokenGenerator.generateKey();
72+
Instant issuedAt = Instant.now();
73+
Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);// TODO Allow configuration for access token lifespan
74+
OAuth2AccessToken accessToken = new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER,
75+
tokenValue, issuedAt, expiresAt, requestedScopes);
76+
77+
return new OAuth2AccessTokenAuthenticationToken(
78+
clientPrincipal.getRegisteredClient(), clientPrincipal, accessToken);
79+
}
80+
81+
@Override
82+
public boolean supports(Class<?> authentication) {
83+
return OAuth2ClientCredentialsAuthenticationToken.class.isAssignableFrom(authentication);
84+
}
85+
}

‎core/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientCredentialsAuthenticationToken.java‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/*
2+
* Copyright 2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.server.authorization.authentication;
18+
19+
import java.util.Collections;
20+
import java.util.Set;
21+
22+
import org.springframework.security.authentication.AbstractAuthenticationToken;
23+
import org.springframework.security.core.Authentication;
24+
import org.springframework.security.oauth2.server.authorization.Version;
25+
import org.springframework.util.Assert;
26+
27+
/**
28+
* An {@link Authentication} implementation used for the OAuth 2.0 Client Credentials Grant.
29+
*
30+
* @author Alexey Nesterov
31+
* @since 0.0.1
32+
* @see Authentication
33+
* @see OAuth2ClientCredentialsAuthenticationProvider
34+
*/
35+
public class OAuth2ClientCredentialsAuthenticationToken extends AbstractAuthenticationToken {
36+
37+
private static final long serialVersionUID = Version.SERIAL_VERSION_UID;
38+
39+
private final Authentication clientPrincipal;
40+
private final Set<String> scopes;
41+
42+
public OAuth2ClientCredentialsAuthenticationToken(Authentication clientPrincipal, Set<String> scopes) {
43+
super(Collections.emptyList());
44+
Assert.notNull(clientPrincipal, "clientPrincipal cannot be null");
45+
Assert.notNull(scopes, "scopes cannot be null");
46+
this.clientPrincipal = clientPrincipal;
47+
this.scopes = scopes;
48+
}
49+
50+
@SuppressWarnings("unchecked")
51+
public OAuth2ClientCredentialsAuthenticationToken(OAuth2ClientAuthenticationToken clientPrincipal) {
52+
this(clientPrincipal, Collections.EMPTY_SET);
53+
}
54+
55+
@Override
56+
public Object getCredentials() {
57+
return "";
58+
}
59+
60+
@Override
61+
public Object getPrincipal() {
62+
return this.clientPrincipal;
63+
}
64+
65+
public Set<String> getScopes() {
66+
return this.scopes;
67+
}
68+
}

‎core/src/main/java/org/springframework/security/oauth2/server/authorization/web/DelegatingAuthorizationGrantAuthenticationConverter.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright 2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.server.authorization.web;
18+
19+
import javax.servlet.http.HttpServletRequest;
20+
import java.util.Collections;
21+
import java.util.Map;
22+
23+
import org.springframework.core.convert.converter.Converter;
24+
import org.springframework.security.core.Authentication;
25+
import org.springframework.security.oauth2.core.AuthorizationGrantType;
26+
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
27+
import org.springframework.util.Assert;
28+
import org.springframework.util.StringUtils;
29+
30+
/**
31+
* A {@link Converter} that delegates actual conversion to one of the provided converters based on grant_type param of a request.
32+
* Returns null is grant type is not specified or not supported.
33+
*
34+
* @author Alexey Nesterov
35+
* @since 0.0.1
36+
*/
37+
public final class DelegatingAuthorizationGrantAuthenticationConverter implements Converter<HttpServletRequest, Authentication> {
38+
39+
private final Map<AuthorizationGrantType, Converter<HttpServletRequest, Authentication>> converters;
40+
41+
public DelegatingAuthorizationGrantAuthenticationConverter(Map<AuthorizationGrantType, Converter<HttpServletRequest, Authentication>> converters) {
42+
Assert.notEmpty(converters, "converters cannot be empty");
43+
44+
this.converters = Collections.unmodifiableMap(converters);
45+
}
46+
47+
@Override
48+
public Authentication convert(HttpServletRequest request) {
49+
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
50+
if (StringUtils.isEmpty(grantType)) {
51+
return null;
52+
}
53+
54+
Converter<HttpServletRequest, Authentication> converter = this.converters.get(new AuthorizationGrantType(grantType));
55+
if (converter == null) {
56+
return null;
57+
}
58+
59+
return converter.convert(request);
60+
}
61+
}

‎core/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilter.java‎

Lines changed: 50 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@
3535
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
3636
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AccessTokenAuthenticationToken;
3737
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationToken;
38+
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
39+
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientCredentialsAuthenticationToken;
3840
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
3941
import org.springframework.security.web.util.matcher.RequestMatcher;
4042
import org.springframework.util.Assert;
@@ -48,6 +50,11 @@
4850
import javax.servlet.http.HttpServletResponse;
4951
import java.io.IOException;
5052
import java.time.temporal.ChronoUnit;
53+
import java.util.Arrays;
54+
import java.util.HashMap;
55+
import java.util.HashSet;
56+
import java.util.Map;
57+
import java.util.Set;
5158

5259
/**
5360
* A {@code Filter} for the OAuth 2.0 Authorization Code Grant,
@@ -86,8 +93,8 @@ public class OAuth2TokenEndpointFilter extends OncePerRequestFilter {
8693
private final AuthenticationManager authenticationManager;
8794
private final OAuth2AuthorizationService authorizationService;
8895
private final RequestMatcher tokenEndpointMatcher;
89-
private final Converter<HttpServletRequest, Authentication> authorizationGrantAuthenticationConverter =
90-
new AuthorizationCodeAuthenticationConverter();
96+
private final Converter<HttpServletRequest, Authentication> authorizationGrantAuthenticationConverter;
97+
9198
private final HttpMessageConverter<OAuth2AccessTokenResponse> accessTokenHttpResponseConverter =
9299
new OAuth2AccessTokenResponseHttpMessageConverter();
93100
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
@@ -119,6 +126,11 @@ public OAuth2TokenEndpointFilter(AuthenticationManager authenticationManager,
119126
this.authenticationManager = authenticationManager;
120127
this.authorizationService = authorizationService;
121128
this.tokenEndpointMatcher = new AntPathRequestMatcher(tokenEndpointUri, HttpMethod.POST.name());
129+
130+
Map<AuthorizationGrantType, Converter<HttpServletRequest, Authentication>> converters = new HashMap<>();
131+
converters.put(AuthorizationGrantType.AUTHORIZATION_CODE, new AuthorizationCodeAuthenticationConverter());
132+
converters.put(AuthorizationGrantType.CLIENT_CREDENTIALS, new ClientCredentialsAuthenticationConverter());
133+
this.authorizationGrantAuthenticationConverter = new DelegatingAuthorizationGrantAuthenticationConverter(converters);
122134
}
123135

124136
@Override
@@ -131,8 +143,16 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
131143
}
132144

133145
try {
134-
Authentication authorizationGrantAuthentication =
135-
this.authorizationGrantAuthenticationConverter.convert(request);
146+
String[] grantTypes = request.getParameterValues(OAuth2ParameterNames.GRANT_TYPE);
147+
if (grantTypes == null || grantTypes.length == 0) {
148+
throwError(OAuth2ErrorCodes.INVALID_REQUEST, "grant_type");
149+
}
150+
151+
Authentication authorizationGrantAuthentication = this.authorizationGrantAuthenticationConverter.convert(request);
152+
if (authorizationGrantAuthentication == null) {
153+
throwError(OAuth2ErrorCodes.UNSUPPORTED_GRANT_TYPE, "grant_type");
154+
}
155+
136156
OAuth2AccessTokenAuthenticationToken accessTokenAuthentication =
137157
(OAuth2AccessTokenAuthenticationToken) this.authenticationManager.authenticate(authorizationGrantAuthentication);
138158
sendAccessTokenResponse(response, accessTokenAuthentication.getAccessToken());
@@ -161,7 +181,7 @@ private void sendErrorResponse(HttpServletResponse response, OAuth2Error error)
161181
this.errorHttpResponseConverter.write(error, null, httpResponse);
162182
}
163183

164-
private static OAuth2AuthenticationException throwError(String errorCode, String parameterName) {
184+
private static void throwError(String errorCode, String parameterName) {
165185
OAuth2Error error = new OAuth2Error(errorCode, "OAuth 2.0 Parameter: " + parameterName,
166186
"https://tools.ietf.org/html/rfc6749#section-5.2");
167187
throw new OAuth2AuthenticationException(error);
@@ -214,4 +234,29 @@ public Authentication convert(HttpServletRequest request) {
214234
new OAuth2AuthorizationCodeAuthenticationToken(code, clientId, redirectUri);
215235
}
216236
}
237+
238+
private static class ClientCredentialsAuthenticationConverter implements Converter<HttpServletRequest, Authentication> {
239+
240+
@Override
241+
public Authentication convert(HttpServletRequest request) {
242+
final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
243+
final OAuth2ClientAuthenticationToken clientAuthenticationToken = (OAuth2ClientAuthenticationToken) authentication;
244+
245+
// grant_type (REQUIRED)
246+
String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
247+
if (!AuthorizationGrantType.CLIENT_CREDENTIALS.getValue().equals(grantType)) {
248+
throwError(OAuth2ErrorCodes.UNSUPPORTED_GRANT_TYPE, OAuth2ParameterNames.GRANT_TYPE);
249+
}
250+
251+
// scope (OPTIONAL)
252+
// https://tools.ietf.org/html/rfc6749#section-4.4.2
253+
String scopeParameter = request.getParameter(OAuth2ParameterNames.SCOPE);
254+
if (StringUtils.isEmpty(scopeParameter)) {
255+
return new OAuth2ClientCredentialsAuthenticationToken(clientAuthenticationToken);
256+
}
257+
258+
Set<String> requestedScopes = new HashSet<>(Arrays.asList(StringUtils.delimitedListToStringArray(scopeParameter, " ")));
259+
return new OAuth2ClientCredentialsAuthenticationToken(clientAuthenticationToken, requestedScopes);
260+
}
261+
}
217262
}

0 commit comments

Comments
 (0)