Skip to content

Commit 5560bba

Browse files
author
Steve Riesenberg
committed
Merge branch '5.2.x' into 5.3.x
2 parents e40ca31 + 7500458 commit 5560bba

14 files changed

+147
-94
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -153,7 +153,7 @@ BodyInserters.FormInserter<String> populateTokenRequestBody(T grantRequest, Body
153153
* server returned no scopes.
154154
*/
155155
Set<String> defaultScopes(T grantRequest) {
156-
return scopes(grantRequest);
156+
return Collections.emptySet();
157157
}
158158

159159
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClient.java

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -27,7 +27,6 @@
2727
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
2828
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
2929
import org.springframework.util.Assert;
30-
import org.springframework.util.CollectionUtils;
3130
import org.springframework.web.client.ResponseErrorHandler;
3231
import org.springframework.web.client.RestClientException;
3332
import org.springframework.web.client.RestOperations;
@@ -78,20 +77,12 @@ public OAuth2AccessTokenResponse getTokenResponse(OAuth2AuthorizationCodeGrantRe
7877
"An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: " + ex.getMessage(), null);
7978
throw new OAuth2AuthorizationException(oauth2Error, ex);
8079
}
81-
82-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
83-
84-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
85-
// As per spec, in Section 5.1 Successful Access Token Response
86-
// https://tools.ietf.org/html/rfc6749#section-5.1
87-
// If AccessTokenResponse.scope is empty, then default to the scope
88-
// originally requested by the client in the Token Request
89-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
90-
.scopes(authorizationCodeGrantRequest.getClientRegistration().getScopes())
91-
.build();
92-
}
93-
94-
return tokenResponse;
80+
// As per spec, in Section 5.1 Successful Access Token Response
81+
// https://tools.ietf.org/html/rfc6749#section-5.1
82+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
83+
// granted.
84+
// However, we use the explicit scopes returned in the response (if any).
85+
return response.getBody();
9586
}
9687

9788
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClient.java

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -27,7 +27,6 @@
2727
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
2828
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
2929
import org.springframework.util.Assert;
30-
import org.springframework.util.CollectionUtils;
3130
import org.springframework.web.client.ResponseErrorHandler;
3231
import org.springframework.web.client.RestClientException;
3332
import org.springframework.web.client.RestOperations;
@@ -78,20 +77,12 @@ public OAuth2AccessTokenResponse getTokenResponse(OAuth2ClientCredentialsGrantRe
7877
"An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: " + ex.getMessage(), null);
7978
throw new OAuth2AuthorizationException(oauth2Error, ex);
8079
}
81-
82-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
83-
84-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
85-
// As per spec, in Section 5.1 Successful Access Token Response
86-
// https://tools.ietf.org/html/rfc6749#section-5.1
87-
// If AccessTokenResponse.scope is empty, then default to the scope
88-
// originally requested by the client in the Token Request
89-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
90-
.scopes(clientCredentialsGrantRequest.getClientRegistration().getScopes())
91-
.build();
92-
}
93-
94-
return tokenResponse;
80+
// As per spec, in Section 5.1 Successful Access Token Response
81+
// https://tools.ietf.org/html/rfc6749#section-5.1
82+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
83+
// granted.
84+
// However, we use the explicit scopes returned in the response (if any).
85+
return response.getBody();
9586
}
9687

9788
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClient.java

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -27,7 +27,6 @@
2727
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
2828
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
2929
import org.springframework.util.Assert;
30-
import org.springframework.util.CollectionUtils;
3130
import org.springframework.web.client.ResponseErrorHandler;
3231
import org.springframework.web.client.RestClientException;
3332
import org.springframework.web.client.RestOperations;
@@ -78,20 +77,12 @@ public OAuth2AccessTokenResponse getTokenResponse(OAuth2PasswordGrantRequest pas
7877
"An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: " + ex.getMessage(), null);
7978
throw new OAuth2AuthorizationException(oauth2Error, ex);
8079
}
81-
82-
OAuth2AccessTokenResponse tokenResponse = response.getBody();
83-
84-
if (CollectionUtils.isEmpty(tokenResponse.getAccessToken().getScopes())) {
85-
// As per spec, in Section 5.1 Successful Access Token Response
86-
// https://tools.ietf.org/html/rfc6749#section-5.1
87-
// If AccessTokenResponse.scope is empty, then default to the scope
88-
// originally requested by the client in the Token Request
89-
tokenResponse = OAuth2AccessTokenResponse.withResponse(tokenResponse)
90-
.scopes(passwordGrantRequest.getClientRegistration().getScopes())
91-
.build();
92-
}
93-
94-
return tokenResponse;
80+
// As per spec, in Section 5.1 Successful Access Token Response
81+
// https://tools.ietf.org/html/rfc6749#section-5.1
82+
// If AccessTokenResponse.scope is empty, then we assume all requested scopes were
83+
// granted.
84+
// However, we use the explicit scopes returned in the response (if any).
85+
return response.getBody();
9586
}
9687

9788
/**

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveAuthorizationCodeTokenResponseClient.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -57,11 +57,6 @@ Set<String> scopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
5757
return Collections.emptySet();
5858
}
5959

60-
@Override
61-
Set<String> defaultScopes(OAuth2AuthorizationCodeGrantRequest grantRequest) {
62-
return grantRequest.getAuthorizationExchange().getAuthorizationRequest().getScopes();
63-
}
64-
6560
@Override
6661
BodyInserters.FormInserter<String> populateTokenRequestBody(
6762
OAuth2AuthorizationCodeGrantRequest grantRequest,

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactiveClientCredentialsTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/WebClientReactivePasswordTokenResponseClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultAuthorizationCodeTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -218,7 +218,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
218218
}
219219

220220
@Test
221-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
221+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
222222
String accessTokenSuccessResponse = "{\n" +
223223
" \"access_token\": \"access-token-1234\",\n" +
224224
" \"token_type\": \"bearer\",\n" +
@@ -230,7 +230,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
230230
OAuth2AccessTokenResponse accessTokenResponse =
231231
this.tokenResponseClient.getTokenResponse(this.authorizationCodeGrantRequest());
232232

233-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
233+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
234234
}
235235

236236
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultClientCredentialsTokenResponseClientTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -222,7 +222,7 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
222222
}
223223

224224
@Test
225-
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasDefaultScope() {
225+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
226226
String accessTokenSuccessResponse = "{\n" +
227227
" \"access_token\": \"access-token-1234\",\n" +
228228
" \"token_type\": \"bearer\",\n" +
@@ -235,7 +235,7 @@ public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessToke
235235

236236
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient.getTokenResponse(clientCredentialsGrantRequest);
237237

238-
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read", "write");
238+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
239239
}
240240

241241
@Test

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/endpoint/DefaultPasswordTokenResponseClientTests.java

Lines changed: 33 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -86,11 +86,14 @@ public void getTokenResponseWhenRequestIsNullThenThrowIllegalArgumentException()
8686

8787
@Test
8888
public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() throws Exception {
89-
String accessTokenSuccessResponse = "{\n" +
90-
" \"access_token\": \"access-token-1234\",\n" +
91-
" \"token_type\": \"bearer\",\n" +
92-
" \"expires_in\": \"3600\"\n" +
93-
"}\n";
89+
// @formatter:off
90+
String accessTokenSuccessResponse = "{\n"
91+
+ " \"access_token\": \"access-token-1234\",\n"
92+
+ " \"token_type\": \"bearer\",\n"
93+
+ " \"expires_in\": \"3600\",\n"
94+
+ " \"scope\": \"read write\"\n"
95+
+ "}\n";
96+
// @formatter:on
9497
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
9598

9699
Instant expiresAtBefore = Instant.now().plusSeconds(3600);
@@ -123,11 +126,14 @@ public void getTokenResponseWhenSuccessResponseThenReturnAccessTokenResponse() t
123126

124127
@Test
125128
public void getTokenResponseWhenClientAuthenticationPostThenFormParametersAreSent() throws Exception {
126-
String accessTokenSuccessResponse = "{\n" +
127-
" \"access_token\": \"access-token-1234\",\n" +
128-
" \"token_type\": \"bearer\",\n" +
129-
" \"expires_in\": \"3600\"\n" +
130-
"}\n";
129+
// @formatter:off
130+
String accessTokenSuccessResponse = "{\n"
131+
+ " \"access_token\": \"access-token-1234\",\n"
132+
+ " \"token_type\": \"bearer\",\n"
133+
+ " \"expires_in\": \"3600\",\n"
134+
+ " \"scope\": \"read\"\n"
135+
+ "}\n";
136+
// @formatter:on
131137
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
132138

133139
ClientRegistration clientRegistration = this.clientRegistrationBuilder
@@ -186,6 +192,22 @@ public void getTokenResponseWhenSuccessResponseIncludesScopeThenAccessTokenHasRe
186192
assertThat(accessTokenResponse.getAccessToken().getScopes()).containsExactly("read");
187193
}
188194

195+
@Test
196+
public void getTokenResponseWhenSuccessResponseDoesNotIncludeScopeThenAccessTokenHasNoScope() {
197+
// @formatter:off
198+
String accessTokenSuccessResponse = "{\n"
199+
+ " \"access_token\": \"access-token-1234\",\n"
200+
+ " \"token_type\": \"bearer\",\n"
201+
+ " \"expires_in\": \"3600\"\n"
202+
+ "}\n";
203+
// @formatter:on
204+
this.server.enqueue(jsonResponse(accessTokenSuccessResponse));
205+
OAuth2PasswordGrantRequest passwordGrantRequest = new OAuth2PasswordGrantRequest(
206+
this.clientRegistrationBuilder.build(), this.username, this.password);
207+
OAuth2AccessTokenResponse accessTokenResponse = this.tokenResponseClient.getTokenResponse(passwordGrantRequest);
208+
assertThat(accessTokenResponse.getAccessToken().getScopes()).isEmpty();
209+
}
210+
189211
@Test
190212
public void getTokenResponseWhenErrorResponseThenThrowOAuth2AuthorizationException() {
191213
String accessTokenErrorResponse = "{\n" +

0 commit comments

Comments
 (0)