Skip to content

Commit 3e2ac82

Browse files
author
Steve Riesenberg
committed
Merge branch '5.3.x' into 5.4.x
2 parents ffae2f6 + 5560bba commit 3e2ac82

14 files changed

+122
-72
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -166,7 +166,7 @@ BodyInserters.FormInserter<String> populateTokenRequestBody(T grantRequest,
166166
* no scopes.
167167
*/
168168
Set<String> defaultScopes(T grantRequest) {
169-
return scopes(grantRequest);
169+
return Collections.emptySet();
170170
}
171171

172172
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClient.java

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -76,19 +75,12 @@ public OAuth2AccessTokenResponse getTokenResponse(
7675
Assert.notNull(authorizationCodeGrantRequest, "authorizationCodeGrantRequest cannot be null");
7776
RequestEntity<?> request = this.requestEntityConverter.convert(authorizationCodeGrantRequest);
7877
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
79-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
80-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
81-
// As per spec, in Section 5.1 Successful Access Token Response
82-
// https://tools.ietf.org/html/rfc6749#section-5.1
83-
// If AccessTokenResponse.scope is empty, then default to the scope
84-
// originally requested by the client in the Token Request
85-
// @formatter:off
86-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
87-
.scopes(authorizationCodeGrantRequest.getClientRegistration().getScopes())
88-
.build();
89-
// @formatter:on
90-
}
91-
return tokenResponse;
78+
// As per spec, in Section 5.1 Successful Access Token Response
79+
// https://tools.ietf.org/html/rfc6749#section-5.1
80+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
81+
// granted.
82+
// However, we use the explicit scopes returned in the response (if any).
83+
return response.getBody();
9284
}
9385

9486
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClient.java

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -76,19 +75,12 @@ public OAuth2AccessTokenResponse getTokenResponse(
7675
Assert.notNull(clientCredentialsGrantRequest, "clientCredentialsGrantRequest cannot be null");
7776
RequestEntity<?> request = this.requestEntityConverter.convert(clientCredentialsGrantRequest);
7877
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
79-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
80-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
81-
// As per spec, in Section 5.1 Successful Access Token Response
82-
// https://tools.ietf.org/html/rfc6749#section-5.1
83-
// If AccessTokenResponse.scope is empty, then default to the scope
84-
// originally requested by the client in the Token Request
85-
// @formatter:off
86-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
87-
.scopes(clientCredentialsGrantRequest.getClientRegistration().getScopes())
88-
.build();
89-
// @formatter:on
90-
}
91-
return tokenResponse;
78+
// As per spec, in Section 5.1 Successful Access Token Response
79+
// https://tools.ietf.org/html/rfc6749#section-5.1
80+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
81+
// granted.
82+
// However, we use the explicit scopes returned in the response (if any).
83+
return response.getBody();
9284
}
9385

9486
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClient.java

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,7 +30,6 @@
3030
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
3131
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
3232
import org.springframework.util.Assert;
33-
import org.springframework.util.CollectionUtils;
3433
import org.springframework.web.client.ResponseErrorHandler;
3534
import org.springframework.web.client.RestClientException;
3635
import org.springframework.web.client.RestOperations;
@@ -75,16 +74,12 @@ public OAuth2AccessTokenResponse getTokenResponse(OAuth2PasswordGrantRequest pas
7574
Assert.notNull(passwordGrantRequest, "passwordGrantRequest cannot be null");
7675
RequestEntity<?> request = this.requestEntityConverter.convert(passwordGrantRequest);
7776
ResponseEntity<OAuth2AccessTokenResponse> response = getResponse(request);
78-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
79-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
80-
// As per spec, in Section 5.1 Successful Access Token Response
81-
// https://tools.ietf.org/html/rfc6749#section-5.1
82-
// If AccessTokenResponse.scope is empty, then default to the scope
83-
// originally requested by the client in the Token Request
84-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
85-
.scopes(passwordGrantRequest.getClientRegistration().getScopes()).build();
86-
}
87-
return tokenResponse;
77+
// As per spec, in Section 5.1 Successful Access Token Response
78+
// https://tools.ietf.org/html/rfc6749#section-5.1
79+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
80+
// granted.
81+
// However, we use the explicit scopes returned in the response (if any).
82+
return response.getBody();
8883
}
8984

9085
private ResponseEntity<OAuth2AccessTokenResponse> getResponse(RequestEntity<?> request) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveAuthorizationCodeTokenResponseClient.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -65,11 +65,6 @@ Set<String> scopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
6565
return Collections.emptySet();
6666
}
6767

68-
@Override
69-
Set<String> defaultScopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
70-
return grantRequest.getAuthorizationExchange().getAuthorizationRequest().getScopes();
71-
}
72-
7368
@Override
7469
BodyInserters.FormInserter<String> populateTokenRequestBody(OAuth2AuthorizationCodeGrantRequest grantRequest,
7570
BodyInserters.FormInserter<String> body) {

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveClientCredentialsTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactivePasswordTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -220,7 +220,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
220220
}
221221

222222
@Test
223-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
223+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
224224
// @formatter:off
225225
String accessTokenSuccessResponse = "{\n"
226226
+ " \"access_token\": \"access-token-1234\",\n"
@@ -232,7 +232,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
232232
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
233233
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
234234
.getTokenResponse(this.authorizationCodeGrantRequest());
235-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
235+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
236236
}
237237

238238
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -222,7 +222,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
222222
}
223223

224224
@Test
225-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
225+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
226226
// @formatter:off
227227
String accessTokenSuccessResponse = "{\n"
228228
+ " \"access_token\": \"access-token-1234\",\n"
@@ -235,7 +235,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
235235
this.clientRegistration);
236236
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient
237237
.getTokenResponse(clientCredentialsGrantRequest);
238-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
238+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
239239
}
240240

241241
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClientTests.java

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -92,7 +92,8 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
9292
String accessTokenSuccessResponse = "{\n"
9393
+ " \"access_token\": \"access-token-1234\",\n"
9494
+ " \"token_type\": \"bearer\",\n"
95-
+ " \"expires_in\": \"3600\"\n"
95+
+ " \"expires_in\": \"3600\",\n"
96+
+ " \"scope\": \"read write\"\n"
9697
+ "}\n";
9798
// @formatter:on
9899
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -126,7 +127,8 @@ public void getTokenResponseWhenClientAuthenticationPostThenFormParametersAreSen
126127
String accessTokenSuccessResponse = "{\n"
127128
+ " \"access_token\": \"access-token-1234\",\n"
128129
+ " \"token_type\": \"bearer\",\n"
129-
+ " \"expires_in\": \"3600\"\n"
130+
+ " \"expires_in\": \"3600\",\n"
131+
+ " \"scope\": \"read\"\n"
130132
+ "}\n";
131133
// @formatter:on
132134
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
@@ -181,6 +183,22 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
181183
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read");
182184
}
183185

186+
@Test
187+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
188+
// @formatter:off
189+
String accessTokenSuccessResponse = "{\n"
190+
+ " \"access_token\": \"access-token-1234\",\n"
191+
+ " \"token_type\": \"bearer\",\n"
192+
+ " \"expires_in\": \"3600\"\n"
193+
+ "}\n";
194+
// @formatter:on
195+
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
196+
OAuth2PasswordGrantRequest passwordGrantRequest = new OAuth2PasswordGrantRequest(
197+
this.clientRegistrationBuilder.build(), this.username, this.password);
198+
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient.getTokenResponse(passwordGrantRequest);
199+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
200+
}
201+
184202
@Test
185203
public void getTokenResponseWhenErrorResponseThenThrowOAuth2AuthorizationException() {
186204
String accessTokenErrorResponse = "{\n" + " \"error\": \"unauthorized_client\"\n" + "}\n";

0 commit comments

Comments
 (0)