Skip to content

Commit fc8b6b5

Browse files
jgrandjajgrandja
committed
Return PAR endpoint metadata only when enabled
Issue spring-projects/spring-authorization-server#2219
1 parent 9dc27be commit fc8b6b5

File tree

8 files changed

+110
-8
lines changed

8 files changed

+110
-8
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -482,6 +482,27 @@ public void configure(HttpSecurity httpSecurity) {
482482
});
483483
}
484484

485+
OAuth2PushedAuthorizationRequestEndpointConfigurer pushedAuthorizationRequestEndpointConfigurer = getConfigurer(
486+
OAuth2PushedAuthorizationRequestEndpointConfigurer.class);
487+
if (pushedAuthorizationRequestEndpointConfigurer != null) {
488+
OAuth2AuthorizationServerMetadataEndpointConfigurer authorizationServerMetadataEndpointConfigurer = getConfigurer(
489+
OAuth2AuthorizationServerMetadataEndpointConfigurer.class);
490+
491+
authorizationServerMetadataEndpointConfigurer.addDefaultAuthorizationServerMetadataCustomizer((builder) -> {
492+
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
493+
String issuer = authorizationServerContext.getIssuer();
494+
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext
495+
.getAuthorizationServerSettings();
496+
497+
String pushedAuthorizationRequestEndpoint = UriComponentsBuilder.fromUriString(issuer)
498+
.path(authorizationServerSettings.getPushedAuthorizationRequestEndpoint())
499+
.build()
500+
.toUriString();
501+
502+
builder.pushedAuthorizationRequestEndpoint(pushedAuthorizationRequestEndpoint);
503+
});
504+
}
505+
485506
this.configurers.values().forEach((configurer) -> configurer.configure(httpSecurity));
486507

487508
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcConfigurer.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,28 @@ void configure(HttpSecurity httpSecurity) {
171171
});
172172
}
173173

174+
OAuth2PushedAuthorizationRequestEndpointConfigurer pushedAuthorizationRequestEndpointConfigurer = httpSecurity
175+
.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
176+
.getConfigurer(OAuth2PushedAuthorizationRequestEndpointConfigurer.class);
177+
if (pushedAuthorizationRequestEndpointConfigurer != null) {
178+
OidcProviderConfigurationEndpointConfigurer providerConfigurationEndpointConfigurer = getConfigurer(
179+
OidcProviderConfigurationEndpointConfigurer.class);
180+
181+
providerConfigurationEndpointConfigurer.addDefaultProviderConfigurationCustomizer((builder) -> {
182+
AuthorizationServerContext authorizationServerContext = AuthorizationServerContextHolder.getContext();
183+
String issuer = authorizationServerContext.getIssuer();
184+
AuthorizationServerSettings authorizationServerSettings = authorizationServerContext
185+
.getAuthorizationServerSettings();
186+
187+
String pushedAuthorizationRequestEndpoint = UriComponentsBuilder.fromUriString(issuer)
188+
.path(authorizationServerSettings.getPushedAuthorizationRequestEndpoint())
189+
.build()
190+
.toUriString();
191+
192+
builder.pushedAuthorizationRequestEndpoint(pushedAuthorizationRequestEndpoint);
193+
});
194+
}
195+
174196
this.configurers.values().forEach((configurer) -> configurer.configure(httpSecurity));
175197
}
176198

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerMetadataTests.java‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,17 @@ public void requestWhenAuthorizationServerMetadataRequestAndDeviceCodeGrantEnabl
185185
.andExpect(jsonPath("$.grant_types_supported[4]").value(AuthorizationGrantType.DEVICE_CODE.getValue()));
186186
}
187187

188+
@Test
189+
public void requestWhenAuthorizationServerMetadataRequestAndPushedAuthorizationRequestEnabledThenMetadataResponseIncludesPushedAuthorizationRequestEndpoint()
190+
throws Exception {
191+
this.spring.register(AuthorizationServerConfigurationWithPushedAuthorizationRequestEnabled.class).autowire();
192+
193+
this.mvc.perform(get(ISSUER.concat(DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI)))
194+
.andExpect(status().is2xxSuccessful())
195+
.andExpect(jsonPath("$.pushed_authorization_request_endpoint")
196+
.value(ISSUER.concat(this.authorizationServerSettings.getPushedAuthorizationRequestEndpoint())));
197+
}
198+
188199
@EnableWebSecurity
189200
@Import(OAuth2AuthorizationServerConfiguration.class)
190201
static class AuthorizationServerConfiguration {
@@ -301,4 +312,26 @@ SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) th
301312

302313
}
303314

315+
@EnableWebSecurity
316+
@Configuration(proxyBeanMethods = false)
317+
static class AuthorizationServerConfigurationWithPushedAuthorizationRequestEnabled
318+
extends AuthorizationServerConfiguration {
319+
320+
// @formatter:off
321+
@Bean
322+
SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
323+
http
324+
.oauth2AuthorizationServer((authorizationServer) ->
325+
authorizationServer
326+
.pushedAuthorizationRequestEndpoint(Customizer.withDefaults())
327+
)
328+
.authorizeHttpRequests((authorize) ->
329+
authorize.anyRequest().authenticated()
330+
);
331+
return http.build();
332+
}
333+
// @formatter:on
334+
335+
}
336+
304337
}

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcProviderConfigurationTests.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,18 @@ public void requestWhenConfigurationRequestAndDeviceCodeGrantEnabledThenConfigur
159159
.andExpect(jsonPath("$.grant_types_supported[4]").value(AuthorizationGrantType.DEVICE_CODE.getValue()));
160160
}
161161

162+
@Test
163+
public void requestWhenConfigurationRequestAndPushedAuthorizationRequestEnabledThenConfigurationResponseIncludesPushedAuthorizationRequestEndpoint()
164+
throws Exception {
165+
this.spring.register(AuthorizationServerConfigurationWithPushedAuthorizationRequestEnabled.class).autowire();
166+
167+
this.mvc.perform(get(ISSUER.concat(DEFAULT_OIDC_PROVIDER_CONFIGURATION_ENDPOINT_URI)))
168+
.andExpect(status().is2xxSuccessful())
169+
.andExpectAll(defaultConfigurationMatchers(ISSUER))
170+
.andExpect(jsonPath("$.pushed_authorization_request_endpoint")
171+
.value(ISSUER.concat(this.authorizationServerSettings.getPushedAuthorizationRequestEndpoint())));
172+
}
173+
162174
private ResultMatcher[] defaultConfigurationMatchers(String issuer) {
163175
// @formatter:off
164176
return new ResultMatcher[] {
@@ -357,6 +369,26 @@ SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) th
357369

358370
}
359371

372+
@EnableWebSecurity
373+
@Configuration(proxyBeanMethods = false)
374+
static class AuthorizationServerConfigurationWithPushedAuthorizationRequestEnabled
375+
extends AuthorizationServerConfiguration {
376+
377+
// @formatter:off
378+
@Bean
379+
SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
380+
http
381+
.oauth2AuthorizationServer((authorizationServer) ->
382+
authorizationServer
383+
.pushedAuthorizationRequestEndpoint(Customizer.withDefaults())
384+
.oidc(Customizer.withDefaults())
385+
);
386+
return http.build();
387+
}
388+
// @formatter:on
389+
390+
}
391+
360392
@EnableWebSecurity
361393
@Configuration(proxyBeanMethods = false)
362394
static class AuthorizationServerConfigurationWithInvalidIssuerUrl extends AuthorizationServerConfiguration {

‎oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,6 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
101101
OidcProviderConfiguration.Builder providerConfiguration = OidcProviderConfiguration.builder()
102102
.issuer(issuer)
103103
.authorizationEndpoint(asUrl(issuer, authorizationServerSettings.getAuthorizationEndpoint()))
104-
.pushedAuthorizationRequestEndpoint(
105-
asUrl(issuer, authorizationServerSettings.getPushedAuthorizationRequestEndpoint()))
106104
.tokenEndpoint(asUrl(issuer, authorizationServerSettings.getTokenEndpoint()))
107105
.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
108106
.jwkSetUrl(asUrl(issuer, authorizationServerSettings.getJwkSetEndpoint()))

‎oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,6 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
101101
.builder()
102102
.issuer(issuer)
103103
.authorizationEndpoint(asUrl(issuer, authorizationServerSettings.getAuthorizationEndpoint()))
104-
.pushedAuthorizationRequestEndpoint(
105-
asUrl(issuer, authorizationServerSettings.getPushedAuthorizationRequestEndpoint()))
106104
.tokenEndpoint(asUrl(issuer, authorizationServerSettings.getTokenEndpoint()))
107105
.tokenEndpointAuthenticationMethods(clientAuthenticationMethods())
108106
.jwkSetUrl(asUrl(issuer, authorizationServerSettings.getJwkSetEndpoint()))

‎oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilterTests.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,7 @@ public void doFilterWhenConfigurationRequestThenConfigurationResponse() throws E
134134
assertThat(providerConfigurationResponse).contains("\"issuer\":\"https://example.com\"");
135135
assertThat(providerConfigurationResponse)
136136
.contains("\"authorization_endpoint\":\"https://example.com/oauth2/v1/authorize\"");
137-
assertThat(providerConfigurationResponse)
138-
.contains("\"pushed_authorization_request_endpoint\":\"https://example.com/oauth2/v1/par\"");
137+
assertThat(providerConfigurationResponse).doesNotContain("\"pushed_authorization_request_endpoint\"");
139138
assertThat(providerConfigurationResponse).doesNotContain("\"device_authorization_endpoint\"");
140139
assertThat(providerConfigurationResponse)
141140
.contains("\"token_endpoint\":\"https://example.com/oauth2/v1/token\"");

‎oauth2/oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilterTests.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,7 @@ public void doFilterWhenAuthorizationServerMetadataRequestThenMetadataResponse()
130130
assertThat(authorizationServerMetadataResponse).contains("\"issuer\":\"https://example.com\"");
131131
assertThat(authorizationServerMetadataResponse)
132132
.contains("\"authorization_endpoint\":\"https://example.com/oauth2/v1/authorize\"");
133-
assertThat(authorizationServerMetadataResponse)
134-
.contains("\"pushed_authorization_request_endpoint\":\"https://example.com/oauth2/v1/par\"");
133+
assertThat(authorizationServerMetadataResponse).doesNotContain("\"pushed_authorization_request_endpoint\"");
135134
assertThat(authorizationServerMetadataResponse).doesNotContain("\"device_authorization_endpoint\"");
136135
assertThat(authorizationServerMetadataResponse)
137136
.contains("\"token_endpoint\":\"https://example.com/oauth2/v1/token\"");

0 commit comments

Comments
 (0)