Skip to content

Commit 5f39c85

Browse files
jgrandjajgrandja
committed
Polish gh-1068
Issue gh-1077
1 parent 5b690df commit 5f39c85

24 files changed

+285
-150
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeAuthenticationProvider.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ public boolean supports(Class<?> authentication) {
282282
* Sets the {@link SessionRegistry} used to track OpenID Connect sessions.
283283
*
284284
* @param sessionRegistry the {@link SessionRegistry} used to track OpenID Connect sessions
285-
* @since 1.1.0
285+
* @since 1.1
286286
*/
287287
public void setSessionRegistry(SessionRegistry sessionRegistry) {
288288
Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ public Set<String> getRedirectUris() {
152152
* that the End-User's User Agent be redirected to after a logout has been performed.
153153
*
154154
* @return the {@code Set} of post logout redirect URI(s)
155-
* @since 1.1.0
155+
* @since 1.1
156156
*/
157157
public Set<String> getPostLogoutRedirectUris() {
158158
return this.postLogoutRedirectUris;
@@ -447,7 +447,7 @@ public Builder redirectUris(Consumer<Set<String>> redirectUrisConsumer) {
447447
*
448448
* @param postLogoutRedirectUri the post logout redirect URI
449449
* @return the {@link Builder}
450-
* @since 1.1.0
450+
* @since 1.1
451451
*/
452452
public Builder postLogoutRedirectUri(String postLogoutRedirectUri) {
453453
this.postLogoutRedirectUris.add(postLogoutRedirectUri);
@@ -460,7 +460,7 @@ public Builder postLogoutRedirectUri(String postLogoutRedirectUri) {
460460
*
461461
* @param postLogoutRedirectUrisConsumer a {@link Consumer} of the post logout redirect URI(s)
462462
* @return the {@link Builder}
463-
* @since 1.1.0
463+
* @since 1.1
464464
*/
465465
public Builder postLogoutRedirectUris(Consumer<Set<String>> postLogoutRedirectUrisConsumer) {
466466
postLogoutRedirectUrisConsumer.accept(this.postLogoutRedirectUris);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerConfigurer.java

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,19 @@
2323

2424
import com.nimbusds.jose.jwk.source.JWKSource;
2525

26+
import org.springframework.context.ApplicationListener;
27+
import org.springframework.context.event.GenericApplicationListenerAdapter;
28+
import org.springframework.context.event.SmartApplicationListener;
2629
import org.springframework.http.HttpMethod;
2730
import org.springframework.http.HttpStatus;
2831
import org.springframework.security.config.Customizer;
2932
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3033
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
3134
import org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer;
35+
import org.springframework.security.context.DelegatingApplicationListener;
3236
import org.springframework.security.core.Authentication;
3337
import org.springframework.security.core.session.SessionRegistry;
38+
import org.springframework.security.core.session.SessionRegistryImpl;
3439
import org.springframework.security.oauth2.core.OAuth2Error;
3540
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
3641
import org.springframework.security.oauth2.core.OAuth2Token;
@@ -270,7 +275,8 @@ public void init(HttpSecurity httpSecurity) {
270275

271276
if (isOidcEnabled()) {
272277
// Add OpenID Connect session tracking capabilities.
273-
SessionRegistry sessionRegistry = OAuth2ConfigurerUtils.getSessionRegistry(httpSecurity);
278+
initSessionRegistry(httpSecurity);
279+
SessionRegistry sessionRegistry = httpSecurity.getSharedObject(SessionRegistry.class);
274280
OAuth2AuthorizationEndpointConfigurer authorizationEndpointConfigurer =
275281
getConfigurer(OAuth2AuthorizationEndpointConfigurer.class);
276282
authorizationEndpointConfigurer.setSessionAuthenticationStrategy((authentication, request, response) -> {
@@ -388,4 +394,23 @@ private static void validateAuthorizationServerSettings(AuthorizationServerSetti
388394
}
389395
}
390396

397+
private static void initSessionRegistry(HttpSecurity httpSecurity) {
398+
SessionRegistry sessionRegistry = OAuth2ConfigurerUtils.getOptionalBean(httpSecurity, SessionRegistry.class);
399+
if (sessionRegistry == null) {
400+
sessionRegistry = new SessionRegistryImpl();
401+
registerDelegateApplicationListener(httpSecurity, (SessionRegistryImpl) sessionRegistry);
402+
}
403+
httpSecurity.setSharedObject(SessionRegistry.class, sessionRegistry);
404+
}
405+
406+
private static void registerDelegateApplicationListener(HttpSecurity httpSecurity, ApplicationListener<?> delegate) {
407+
DelegatingApplicationListener delegatingApplicationListener =
408+
OAuth2ConfigurerUtils.getOptionalBean(httpSecurity, DelegatingApplicationListener.class);
409+
if (delegatingApplicationListener == null) {
410+
return;
411+
}
412+
SmartApplicationListener smartListener = new GenericApplicationListenerAdapter(delegate);
413+
delegatingApplicationListener.addListener(smartListener);
414+
}
415+
391416
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ConfigurerUtils.java

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,8 @@
2424
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
2525
import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
2626
import org.springframework.context.ApplicationContext;
27-
import org.springframework.context.ApplicationListener;
28-
import org.springframework.context.event.GenericApplicationListenerAdapter;
29-
import org.springframework.context.event.SmartApplicationListener;
3027
import org.springframework.core.ResolvableType;
3128
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
32-
import org.springframework.security.context.DelegatingApplicationListener;
33-
import org.springframework.security.core.session.SessionRegistry;
34-
import org.springframework.security.core.session.SessionRegistryImpl;
3529
import org.springframework.security.oauth2.core.OAuth2Token;
3630
import org.springframework.security.oauth2.jwt.JwtEncoder;
3731
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
@@ -186,28 +180,6 @@ static AuthorizationServerSettings getAuthorizationServerSettings(HttpSecurity h
186180
return authorizationServerSettings;
187181
}
188182

189-
static SessionRegistry getSessionRegistry(HttpSecurity httpSecurity) {
190-
SessionRegistry sessionRegistry = httpSecurity.getSharedObject(SessionRegistry.class);
191-
if (sessionRegistry == null) {
192-
sessionRegistry = getOptionalBean(httpSecurity, SessionRegistry.class);
193-
if (sessionRegistry == null) {
194-
sessionRegistry = new SessionRegistryImpl();
195-
registerDelegateApplicationListener(httpSecurity, (SessionRegistryImpl) sessionRegistry);
196-
}
197-
httpSecurity.setSharedObject(SessionRegistry.class, sessionRegistry);
198-
}
199-
return sessionRegistry;
200-
}
201-
202-
private static void registerDelegateApplicationListener(HttpSecurity httpSecurity, ApplicationListener<?> delegate) {
203-
DelegatingApplicationListener delegatingApplicationListener = getOptionalBean(httpSecurity, DelegatingApplicationListener.class);
204-
if (delegatingApplicationListener == null) {
205-
return;
206-
}
207-
SmartApplicationListener smartListener = new GenericApplicationListenerAdapter(delegate);
208-
delegatingApplicationListener.addListener(smartListener);
209-
}
210-
211183
static <T> T getBean(HttpSecurity httpSecurity, Class<T> type) {
212184
return httpSecurity.getSharedObject(ApplicationContext.class).getBean(type);
213185
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenEndpointConfigurer.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,11 +220,13 @@ private static List<AuthenticationProvider> createDefaultAuthenticationProviders
220220

221221
OAuth2AuthorizationService authorizationService = OAuth2ConfigurerUtils.getAuthorizationService(httpSecurity);
222222
OAuth2TokenGenerator<? extends OAuth2Token> tokenGenerator = OAuth2ConfigurerUtils.getTokenGenerator(httpSecurity);
223-
SessionRegistry sessionRegistry = OAuth2ConfigurerUtils.getSessionRegistry(httpSecurity);
224223

225224
OAuth2AuthorizationCodeAuthenticationProvider authorizationCodeAuthenticationProvider =
226225
new OAuth2AuthorizationCodeAuthenticationProvider(authorizationService, tokenGenerator);
227-
authorizationCodeAuthenticationProvider.setSessionRegistry(sessionRegistry);
226+
SessionRegistry sessionRegistry = httpSecurity.getSharedObject(SessionRegistry.class);
227+
if (sessionRegistry != null) {
228+
authorizationCodeAuthenticationProvider.setSessionRegistry(sessionRegistry);
229+
}
228230
authenticationProviders.add(authorizationCodeAuthenticationProvider);
229231

230232
OAuth2RefreshTokenAuthenticationProvider refreshTokenAuthenticationProvider =

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcConfigurer.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ public OidcConfigurer providerConfigurationEndpoint(Customizer<OidcProviderConfi
7272
*
7373
* @param logoutEndpointCustomizer the {@link Customizer} providing access to the {@link OidcLogoutEndpointConfigurer}
7474
* @return the {@link OidcConfigurer} for further configuration
75-
* @since 1.1.0
75+
* @since 1.1
7676
*/
7777
public OidcConfigurer logoutEndpoint(Customizer<OidcLogoutEndpointConfigurer> logoutEndpointCustomizer) {
7878
logoutEndpointCustomizer.customize(getConfigurer(OidcLogoutEndpointConfigurer.class));

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcLogoutEndpointConfigurer.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.springframework.security.authentication.AuthenticationProvider;
2727
import org.springframework.security.config.annotation.ObjectPostProcessor;
2828
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
29+
import org.springframework.security.core.session.SessionRegistry;
2930
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3031
import org.springframework.security.oauth2.core.OAuth2Error;
3132
import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcLogoutAuthenticationProvider;
@@ -47,7 +48,7 @@
4748
* Configurer for OpenID Connect 1.0 RP-Initiated Logout Endpoint.
4849
*
4950
* @author Joe Grandja
50-
* @since 1.1.0
51+
* @since 1.1
5152
* @see OidcConfigurer#logoutEndpoint
5253
* @see OidcLogoutEndpointFilter
5354
*/
@@ -210,7 +211,7 @@ private static List<AuthenticationProvider> createDefaultAuthenticationProviders
210211
new OidcLogoutAuthenticationProvider(
211212
OAuth2ConfigurerUtils.getRegisteredClientRepository(httpSecurity),
212213
OAuth2ConfigurerUtils.getAuthorizationService(httpSecurity),
213-
OAuth2ConfigurerUtils.getSessionRegistry(httpSecurity));
214+
httpSecurity.getSharedObject(SessionRegistry.class));
214215
authenticationProviders.add(oidcLogoutAuthenticationProvider);
215216

216217
return authenticationProviders;

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcClientMetadataClaimAccessor.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ default List<String> getRedirectUris() {
101101
* that the End-User's User Agent be redirected to after a logout has been performed.
102102
*
103103
* @return the post logout redirection {@code URI} values used by the Client
104-
* @since 1.1.0
104+
* @since 1.1
105105
*/
106106
default List<String> getPostLogoutRedirectUris() {
107107
return getClaimAsStringList(OidcClientMetadataClaimNames.POST_LOGOUT_REDIRECT_URIS);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcClientMetadataClaimNames.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public final class OidcClientMetadataClaimNames {
6666
* {@code post_logout_redirect_uris} - the post logout redirection {@code URI} values used by the Client.
6767
* The {@code post_logout_redirect_uri} parameter is used by the client when requesting
6868
* that the End-User's User Agent be redirected to after a logout has been performed.
69-
* @since 1.1.0
69+
* @since 1.1
7070
*/
7171
public static final String POST_LOGOUT_REDIRECT_URIS = "post_logout_redirect_uris";
7272

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcClientRegistration.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ public Builder redirectUris(Consumer<List<String>> redirectUrisConsumer) {
176176
*
177177
* @param postLogoutRedirectUri the post logout redirection {@code URI} used by the Client
178178
* @return the {@link Builder} for further configuration
179-
* @since 1.1.0
179+
* @since 1.1
180180
*/
181181
public Builder postLogoutRedirectUri(String postLogoutRedirectUri) {
182182
addClaimToClaimList(OidcClientMetadataClaimNames.POST_LOGOUT_REDIRECT_URIS, postLogoutRedirectUri);
@@ -189,7 +189,7 @@ public Builder postLogoutRedirectUri(String postLogoutRedirectUri) {
189189
*
190190
* @param postLogoutRedirectUrisConsumer a {@code Consumer} of the post logout redirection {@code URI} values used by the Client
191191
* @return the {@link Builder} for further configuration
192-
* @since 1.1.0
192+
* @since 1.1
193193
*/
194194
public Builder postLogoutRedirectUris(Consumer<List<String>> postLogoutRedirectUrisConsumer) {
195195
acceptClaimValues(OidcClientMetadataClaimNames.POST_LOGOUT_REDIRECT_URIS, postLogoutRedirectUrisConsumer);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ public Builder userInfoEndpoint(String userInfoEndpoint) {
136136
*
137137
* @param endSessionEndpoint the {@code URL} of the OpenID Connect 1.0 End Session Endpoint
138138
* @return the {@link Builder} for further configuration
139-
* @since 1.1.0
139+
* @since 1.1
140140
*/
141141
public Builder endSessionEndpoint(String endSessionEndpoint) {
142142
return claim(OidcProviderMetadataClaimNames.END_SESSION_ENDPOINT, endSessionEndpoint);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderMetadataClaimAccessor.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ default URL getUserInfoEndpoint() {
7272
* Returns the {@code URL} of the OpenID Connect 1.0 End Session Endpoint {@code (end_session_endpoint)}.
7373
*
7474
* @return the {@code URL} of the OpenID Connect 1.0 End Session Endpoint
75-
* @since 1.1.0
75+
* @since 1.1
7676
*/
7777
default URL getEndSessionEndpoint() {
7878
return getClaimAsURL(OidcProviderMetadataClaimNames.END_SESSION_ENDPOINT);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/OidcProviderMetadataClaimNames.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public final class OidcProviderMetadataClaimNames extends OAuth2AuthorizationSer
4949

5050
/**
5151
* {@code end_session_endpoint} - the {@code URL} of the OpenID Connect 1.0 End Session Endpoint
52-
* @since 1.1.0
52+
* @since 1.1
5353
*/
5454
public static final String END_SESSION_ENDPOINT = "end_session_endpoint";
5555

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcLogoutAuthenticationProvider.java

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
* An {@link AuthenticationProvider} implementation for OpenID Connect 1.0 RP-Initiated Logout Endpoint.
4747
*
4848
* @author Joe Grandja
49-
* @since 1.1.0
49+
* @since 1.1
5050
* @see RegisteredClientRepository
5151
* @see OAuth2AuthorizationService
5252
* @see SessionRegistry
@@ -83,7 +83,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
8383
(OidcLogoutAuthenticationToken) authentication;
8484

8585
OAuth2Authorization authorization = this.authorizationService.findByToken(
86-
oidcLogoutAuthentication.getIdToken(), ID_TOKEN_TOKEN_TYPE);
86+
oidcLogoutAuthentication.getIdTokenHint(), ID_TOKEN_TOKEN_TYPE);
8787
if (authorization == null) {
8888
throwError(OAuth2ErrorCodes.INVALID_TOKEN, "id_token_hint");
8989
}
@@ -120,18 +120,24 @@ public Authentication authenticate(Authentication authentication) throws Authent
120120
this.logger.trace("Validated logout request parameters");
121121
}
122122

123-
// Validate user session
124-
SessionInformation sessionInformation = null;
123+
// Validate user identity
125124
Authentication userPrincipal = (Authentication) oidcLogoutAuthentication.getPrincipal();
126-
if (isPrincipalAuthenticated(userPrincipal) &&
127-
StringUtils.hasText(oidcLogoutAuthentication.getSessionId())) {
128-
sessionInformation = findSessionInformation(
129-
userPrincipal, oidcLogoutAuthentication.getSessionId());
130-
if (sessionInformation != null) {
131-
String sidClaim = idToken.getClaim("sid");
132-
if (!StringUtils.hasText(sidClaim) ||
133-
!sidClaim.equals(sessionInformation.getSessionId())) {
134-
throwError(OAuth2ErrorCodes.INVALID_TOKEN, "sid");
125+
if (isPrincipalAuthenticated(userPrincipal)) {
126+
if (!StringUtils.hasText(idToken.getSubject()) ||
127+
!idToken.getSubject().equals(userPrincipal.getName())) {
128+
throwError(OAuth2ErrorCodes.INVALID_TOKEN, IdTokenClaimNames.SUB);
129+
}
130+
131+
// Check for active session
132+
if (StringUtils.hasText(oidcLogoutAuthentication.getSessionId())) {
133+
SessionInformation sessionInformation = findSessionInformation(
134+
userPrincipal, oidcLogoutAuthentication.getSessionId());
135+
if (sessionInformation != null) {
136+
String sidClaim = idToken.getClaim("sid");
137+
if (!StringUtils.hasText(sidClaim) ||
138+
!sidClaim.equals(sessionInformation.getSessionId())) {
139+
throwError(OAuth2ErrorCodes.INVALID_TOKEN, "sid");
140+
}
135141
}
136142
}
137143
}
@@ -140,8 +146,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
140146
this.logger.trace("Authenticated logout request");
141147
}
142148

143-
return new OidcLogoutAuthenticationToken(oidcLogoutAuthentication.getIdToken(), userPrincipal,
144-
sessionInformation, oidcLogoutAuthentication.getClientId(),
149+
return new OidcLogoutAuthenticationToken(idToken, userPrincipal,
150+
oidcLogoutAuthentication.getSessionId(), oidcLogoutAuthentication.getClientId(),
145151
oidcLogoutAuthentication.getPostLogoutRedirectUri(), oidcLogoutAuthentication.getState());
146152
}
147153

0 commit comments

Comments
 (0)