-
Notifications
You must be signed in to change notification settings - Fork 5.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce Reactive OAuth2Authorization success/failure handlers
All ReactiveOAuth2AuthorizedClientManagers now have authorization success/failure handlers. A success handler is provided to save authorized clients for future requests. A failure handler is provided to remove previously saved authorized clients. ServerOAuth2AuthorizedClientExchangeFilterFunction also makes use of a failure handler in the case of unauthorized or forbidden http status code. The main use cases now handled are - remove authorized client when an authorization server indicates that a refresh token is no longer valid (when authorization server returns invalid_grant) - remove authorized client when a resource server indicates that an access token is no longer valid (when resource server returns invalid_token) Introduced ClientAuthorizationException to capture details needed when removing an authorized client. All ReactiveOAuth2AccessTokenResponseClients now throw a ClientAuthorizationException on failures. Created AbstractWebClientReactiveOAuth2AccessTokenResponseClient to unify common logic between all ReactiveOAuth2AccessTokenResponseClients. Fixes gh-7699
- Loading branch information
Showing
26 changed files
with
2,504 additions
and
480 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
89 changes: 89 additions & 0 deletions
89
...rc/main/java/org/springframework/security/oauth2/client/ClientAuthorizationException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| /* | ||
| * Copyright 2002-2020 the original author or authors. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.springframework.security.oauth2.client; | ||
|
|
||
| import org.springframework.security.oauth2.core.OAuth2AuthorizationException; | ||
| import org.springframework.security.oauth2.core.OAuth2Error; | ||
| import org.springframework.util.Assert; | ||
|
|
||
| /** | ||
| * This exception is thrown on the client side when an attempt to authenticate | ||
| * or authorize an OAuth 2.0 client fails. | ||
| * | ||
| * @author Phil Clay | ||
| * @since 5.3 | ||
| * @see OAuth2AuthorizedClient | ||
| */ | ||
| public class ClientAuthorizationException extends OAuth2AuthorizationException { | ||
|
|
||
| private final String clientRegistrationId; | ||
|
|
||
| /** | ||
| * Constructs a {@code ClientAuthorizationException} using the provided parameters. | ||
| * | ||
| * @param error the {@link OAuth2Error OAuth 2.0 Error} | ||
| * @param clientRegistrationId the identifier for the client's registration | ||
| */ | ||
| public ClientAuthorizationException(OAuth2Error error, String clientRegistrationId) { | ||
| this(error, clientRegistrationId, error.toString()); | ||
| } | ||
| /** | ||
| * Constructs a {@code ClientAuthorizationException} using the provided parameters. | ||
| * | ||
| * @param error the {@link OAuth2Error OAuth 2.0 Error} | ||
| * @param clientRegistrationId the identifier for the client's registration | ||
| * @param message the exception message | ||
| */ | ||
| public ClientAuthorizationException(OAuth2Error error, String clientRegistrationId, String message) { | ||
| super(error, message); | ||
| Assert.hasText(clientRegistrationId, "clientRegistrationId cannot be empty"); | ||
| this.clientRegistrationId = clientRegistrationId; | ||
| } | ||
|
|
||
| /** | ||
| * Constructs a {@code ClientAuthorizationException} using the provided parameters. | ||
| * | ||
| * @param error the {@link OAuth2Error OAuth 2.0 Error} | ||
| * @param clientRegistrationId the identifier for the client's registration | ||
| * @param cause the root cause | ||
| */ | ||
| public ClientAuthorizationException(OAuth2Error error, String clientRegistrationId, Throwable cause) { | ||
| this(error, clientRegistrationId, error.toString(), cause); | ||
| } | ||
|
|
||
| /** | ||
| * Constructs a {@code ClientAuthorizationException} using the provided parameters. | ||
| * | ||
| * @param error the {@link OAuth2Error OAuth 2.0 Error} | ||
| * @param clientRegistrationId the identifier for the client's registration | ||
| * @param message the exception message | ||
| * @param cause the root cause | ||
| */ | ||
| public ClientAuthorizationException(OAuth2Error error, String clientRegistrationId, String message, Throwable cause) { | ||
| super(error, message, cause); | ||
| Assert.hasText(clientRegistrationId, "clientRegistrationId cannot be empty"); | ||
| this.clientRegistrationId = clientRegistrationId; | ||
| } | ||
|
|
||
| /** | ||
| * Returns the identifier for the client's registration. | ||
| * | ||
| * @return the identifier for the client's registration | ||
| */ | ||
| public String getClientRegistrationId() { | ||
| return this.clientRegistrationId; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
51 changes: 51 additions & 0 deletions
51
...org/springframework/security/oauth2/client/ReactiveOAuth2AuthorizationFailureHandler.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| /* | ||
| * Copyright 2002-2020 the original author or authors. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.springframework.security.oauth2.client; | ||
|
|
||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.security.oauth2.core.OAuth2AuthorizationException; | ||
| import reactor.core.publisher.Mono; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Handles when an OAuth 2.0 Client | ||
| * fails to authorize (or re-authorize) | ||
| * via the authorization server or resource server. | ||
| * | ||
| * @author Phil Clay | ||
| * @since 5.3 | ||
| */ | ||
| @FunctionalInterface | ||
| public interface ReactiveOAuth2AuthorizationFailureHandler { | ||
|
|
||
| /** | ||
| * Called when an OAuth 2.0 Client | ||
| * fails to authorize (or re-authorize) | ||
| * via the authorization server or resource server. | ||
| * | ||
| * @param authorizationException the exception that contains details about what failed | ||
| * @param principal the {@code Principal} that was attempted to be authorized | ||
| * @param attributes an immutable {@code Map} of extra optional attributes present under certain conditions. | ||
| * For example, this might contain a {@link org.springframework.web.server.ServerWebExchange ServerWebExchange} | ||
| * if the authorization was performed within the context of a {@code ServerWebExchange}. | ||
| * @return an empty {@link Mono} that completes after this handler has finished handling the event. | ||
| */ | ||
| Mono<Void> onAuthorizationFailure( | ||
| OAuth2AuthorizationException authorizationException, | ||
| Authentication principal, | ||
| Map<String, Object> attributes); | ||
| } |
Oops, something went wrong.