Skip to content

Conversation

sjohnr
Copy link
Contributor

@sjohnr sjohnr commented Sep 21, 2022

Previously, the default authority was ROLE_USER when using oauth2Login() for both OAuth2 and OIDC providers.

  • Default authority for OAuth2UserAuthority is now OAUTH2_USER
  • Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes gh-7856

@sjohnr sjohnr added status: duplicate A duplicate of another issue in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: breaks-passivity A change that breaks passivity with the previous release labels Sep 21, 2022
@sjohnr sjohnr added this to the 6.0.x milestone Sep 21, 2022
@sjohnr sjohnr requested a review from jgrandja September 21, 2022 15:37
@sjohnr sjohnr self-assigned this Sep 21, 2022
@sjohnr sjohnr force-pushed the gh-7856-oidc-user-authority branch 2 times, most recently from 21555d9 to 6df7a92 Compare September 21, 2022 16:27
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.

* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes spring-projectsgh-7856
@sjohnr sjohnr force-pushed the gh-7856-oidc-user-authority branch from 6df7a92 to bcc3e95 Compare September 21, 2022 20:11
Copy link
Contributor

@jgrandja jgrandja left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @sjohnr.

There are 2 minor updates needed and then please go ahead and merge.

Thanks!

@sjohnr
Copy link
Contributor Author

sjohnr commented Sep 26, 2022

Merged via 181ee74.

@sjohnr sjohnr closed this Sep 26, 2022
@sjohnr sjohnr deleted the gh-7856-oidc-user-authority branch September 26, 2022 15:09
@sjohnr sjohnr modified the milestones: 6.0.x, 6.0.0-RC1 Sep 27, 2022
sjohnr pushed a commit to sjohnr/spring-security that referenced this pull request Nov 10, 2022
sjohnr pushed a commit that referenced this pull request Nov 14, 2022
sjohnr pushed a commit that referenced this pull request Nov 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: breaks-passivity A change that breaks passivity with the previous release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OidcUserAuthority should not automatically include ROLE_USER authority

2 participants