[improve][client] Make authorization server metadata path configurable in AuthenticationOAuth2 #25052
Conversation
github-actions
bot
added
the
doc-required
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #25052 +/- ##
=============================================
+ Coverage 38.50% 74.38% +35.88%
- Complexity 13234 34133 +20899
=============================================
Files 1863 1922 +59
Lines 146150 150408 +4258
Branches 16973 17471 +498
=============================================
+ Hits 56272 111878 +55606
+ Misses 82185 29604 -52581
- Partials 7693 8926 +1233
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Technoboy-
left a comment
Technoboy-
left a comment
There was a problem hiding this comment.
@poorbarcode @lhotari could you help review this ?
| public class AuthenticationOAuth2StandardAuthzServer extends AuthenticationOAuth2 { | ||
|
|
||
| private static final long serialVersionUID = 1L; | ||
|
|
||
| public AuthenticationOAuth2StandardAuthzServer() { | ||
| super(); | ||
| } | ||
|
|
||
| AuthenticationOAuth2StandardAuthzServer(Flow flow, Clock clock) { | ||
| super(flow, clock); | ||
| } | ||
|
|
||
| @Override | ||
| public void configure(String encodedAuthParamString) { | ||
| if (StringUtils.isBlank(encodedAuthParamString)) { | ||
| throw new IllegalArgumentException("No authentication parameters were provided"); | ||
| } | ||
| Map<String, String> params; | ||
| try { | ||
| params = AuthenticationUtil.configureFromJsonString(encodedAuthParamString); | ||
| } catch (IOException e) { | ||
| throw new IllegalArgumentException("Malformed authentication parameters", e); | ||
| } | ||
|
|
||
| // Always set the OAuth 2.0 standard metadata path | ||
| params.put(FlowBase.CONFIG_PARAM_WELL_KNOWN_METADATA_PATH, | ||
| DefaultMetadataResolver.OAUTH_WELL_KNOWN_METADATA_PATH); | ||
|
|
||
| String type = params.getOrDefault(CONFIG_PARAM_TYPE, TYPE_CLIENT_CREDENTIALS); | ||
| switch(type) { | ||
| case TYPE_CLIENT_CREDENTIALS: | ||
| this.flow = ClientCredentialsFlow.fromParameters(params); | ||
| break; | ||
| default: | ||
| throw new IllegalArgumentException("Unsupported authentication type: " + type); | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
What's the purpose of this class? Could we eliminate this?
There was a problem hiding this comment.
This class allows users to switch authentication plugins and use the standard metadata path defined in RFC 8414 without additional configuration.
It’s especially useful for CLI tool, where ClientCredentialsBuilder cannot be used.
@izumo27 It seems that according to RFC 8414, the logic is also different than what there is in the current implementation. https://www.rfc-editor.org/rfc/rfc8414.html#section-3.1
Instead of appending |
|
@lhotari Thank you for the comment. I’ve fixed it.
|
4 participants
Motivation
The client’s OAuth2 authentication plugin can be used for OIDC.
So, the authorization server metadata path is fixed to
/.well-known/openid-configuration.However, RFC 8414 defines
/.well-known/oauth-authorization-serveras the default, and some users may want to configure a different path.https://datatracker.ietf.org/doc/html/rfc8414#section-3
This PR makes the authorization server metadata path configurable.
Modifications
wellKnownMetadataPathparameter to make the authorization server metadata path configurable.AuthenticationOAuth2StandardAuthzServerclass and theclientCredentialsWithStandardAuthzServerBuilderbuilder, which preconfigure the standard path/.well-known/openid-configurationas defined in RFC 8414.Verifying this change
This change added tests and can be verified as follows:
Does this pull request potentially affect one of the following parts:
Documentation
docdoc-requireddoc-not-neededdoc-completeMatching PR in forked repository
PR in forked repository: izumo27#6