Skip to content

Commit e11c188

Browse files
sjohnrsjohnr
committed
Customize the strategy for resolving the principal
Closes gh-15826
1 parent 50cb051 commit e11c188

File tree

4 files changed

+206
-53
lines changed

4 files changed

+206
-53
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/client/OAuth2ClientHttpRequestInterceptor.java

Lines changed: 42 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,6 @@
3434
import org.springframework.security.authentication.AnonymousAuthenticationToken;
3535
import org.springframework.security.core.Authentication;
3636
import org.springframework.security.core.authority.AuthorityUtils;
37-
import org.springframework.security.core.context.SecurityContextHolder;
38-
import org.springframework.security.core.context.SecurityContextHolderStrategy;
3937
import org.springframework.security.oauth2.client.ClientAuthorizationException;
4038
import org.springframework.security.oauth2.client.OAuth2AuthorizationFailureHandler;
4139
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
@@ -121,40 +119,24 @@ public final class OAuth2ClientHttpRequestInterceptor implements ClientHttpReque
121119

122120
private final OAuth2AuthorizedClientManager authorizedClientManager;
123121

124-
private final ClientRegistrationIdResolver clientRegistrationIdResolver;
122+
private ClientRegistrationIdResolver clientRegistrationIdResolver = new RequestAttributeClientRegistrationIdResolver();
123+
124+
private PrincipalResolver principalResolver = new SecurityContextHolderPrincipalResolver();
125125

126126
// @formatter:off
127127
private OAuth2AuthorizationFailureHandler authorizationFailureHandler =
128128
(clientRegistrationId, principal, attributes) -> { };
129129
// @formatter:on
130130

131-
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
132-
.getContextHolderStrategy();
133-
134131
/**
135132
* Constructs a {@code OAuth2ClientHttpRequestInterceptor} using the provided
136133
* parameters.
137134
* @param authorizedClientManager the {@link OAuth2AuthorizedClientManager} which
138135
* manages the authorized client(s)
139136
*/
140137
public OAuth2ClientHttpRequestInterceptor(OAuth2AuthorizedClientManager authorizedClientManager) {
141-
this(authorizedClientManager, new RequestAttributeClientRegistrationIdResolver());
142-
}
143-
144-
/**
145-
* Constructs a {@code OAuth2ClientHttpRequestInterceptor} using the provided
146-
* parameters.
147-
* @param authorizedClientManager the {@link OAuth2AuthorizedClientManager} which
148-
* manages the authorized client(s)
149-
* @param clientRegistrationIdResolver the strategy for resolving a
150-
* {@code clientRegistrationId} from the intercepted request
151-
*/
152-
public OAuth2ClientHttpRequestInterceptor(OAuth2AuthorizedClientManager authorizedClientManager,
153-
ClientRegistrationIdResolver clientRegistrationIdResolver) {
154138
Assert.notNull(authorizedClientManager, "authorizedClientManager cannot be null");
155-
Assert.notNull(clientRegistrationIdResolver, "clientRegistrationIdResolver cannot be null");
156139
this.authorizedClientManager = authorizedClientManager;
157-
this.clientRegistrationIdResolver = clientRegistrationIdResolver;
158140
}
159141

160142
/**
@@ -238,20 +220,31 @@ public static OAuth2AuthorizationFailureHandler authorizationFailureHandler(
238220
}
239221

240222
/**
241-
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
242-
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
243-
* @param securityContextHolderStrategy the {@link SecurityContextHolderStrategy} to
244-
* use
223+
* Sets the strategy for resolving a {@code clientRegistrationId} from an intercepted
224+
* request.
225+
* @param clientRegistrationIdResolver the strategy for resolving a
226+
* {@code clientRegistrationId} from an intercepted request
227+
*/
228+
public void setClientRegistrationIdResolver(ClientRegistrationIdResolver clientRegistrationIdResolver) {
229+
Assert.notNull(clientRegistrationIdResolver, "clientRegistrationIdResolver cannot be null");
230+
this.clientRegistrationIdResolver = clientRegistrationIdResolver;
231+
}
232+
233+
/**
234+
* Sets the strategy for resolving a {@link Authentication principal} from an
235+
* intercepted request.
236+
* @param principalResolver the strategy for resolving a {@link Authentication
237+
* principal}
245238
*/
246-
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
247-
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
248-
this.securityContextHolderStrategy = securityContextHolderStrategy;
239+
public void setPrincipalResolver(PrincipalResolver principalResolver) {
240+
Assert.notNull(principalResolver, "principalResolver cannot be null");
241+
this.principalResolver = principalResolver;
249242
}
250243

251244
@Override
252245
public ClientHttpResponse intercept(HttpRequest request, byte[] body, ClientHttpRequestExecution execution)
253246
throws IOException {
254-
Authentication principal = this.securityContextHolderStrategy.getContext().getAuthentication();
247+
Authentication principal = this.principalResolver.resolve(request);
255248
if (principal == null) {
256249
principal = ANONYMOUS_AUTHENTICATION;
257250
}
@@ -378,4 +371,24 @@ public interface ClientRegistrationIdResolver {
378371

379372
}
380373

374+
/**
375+
* A strategy for resolving a {@link Authentication principal} from an intercepted
376+
* request.
377+
*/
378+
@FunctionalInterface
379+
public interface PrincipalResolver {
380+
381+
/**
382+
* Resolve the {@link Authentication principal} from the current request, which is
383+
* used to obtain an {@link OAuth2AuthorizedClient}.
384+
* @param request the intercepted request, containing HTTP method, URI, headers,
385+
* and request attributes
386+
* @return the {@link Authentication principal} to be used for resolving an
387+
* {@link OAuth2AuthorizedClient}.
388+
*/
389+
@Nullable
390+
Authentication resolve(HttpRequest request);
391+
392+
}
393+
381394
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/client/RequestAttributePrincipalResolver.java

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*
2+
* Copyright 2002-2024 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.client.web.client;
18+
19+
import java.util.Collections;
20+
import java.util.Map;
21+
import java.util.function.Consumer;
22+
23+
import org.springframework.http.HttpRequest;
24+
import org.springframework.http.client.ClientHttpRequest;
25+
import org.springframework.security.authentication.AbstractAuthenticationToken;
26+
import org.springframework.security.core.Authentication;
27+
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
28+
import org.springframework.util.Assert;
29+
30+
/**
31+
* A strategy for resolving a {@link Authentication principal} from an intercepted request
32+
* using {@link ClientHttpRequest#getAttributes() attributes}.
33+
*
34+
* @author Steve Riesenberg
35+
* @since 6.4
36+
*/
37+
public class RequestAttributePrincipalResolver implements OAuth2ClientHttpRequestInterceptor.PrincipalResolver {
38+
39+
private static final String PRINCIPAL_ATTR_NAME = RequestAttributePrincipalResolver.class.getName()
40+
.concat(".principal");
41+
42+
@Override
43+
public Authentication resolve(HttpRequest request) {
44+
return (Authentication) request.getAttributes().get(PRINCIPAL_ATTR_NAME);
45+
}
46+
47+
/**
48+
* Modifies the {@link ClientHttpRequest#getAttributes() attributes} to include the
49+
* {@link Authentication principal} to be used to look up the
50+
* {@link OAuth2AuthorizedClient}.
51+
* @param principal the {@link Authentication principal} to be used to look up the
52+
* {@link OAuth2AuthorizedClient}
53+
* @return the {@link Consumer} to populate the attributes
54+
*/
55+
public static Consumer<Map<String, Object>> principal(Authentication principal) {
56+
Assert.notNull(principal, "principal cannot be null");
57+
return (attributes) -> attributes.put(PRINCIPAL_ATTR_NAME, principal);
58+
}
59+
60+
/**
61+
* Modifies the {@link ClientHttpRequest#getAttributes() attributes} to include the
62+
* {@link Authentication principal} to be used to look up the
63+
* {@link OAuth2AuthorizedClient}.
64+
* @param principalName the {@code principalName} to be used to look up the
65+
* {@link OAuth2AuthorizedClient}
66+
* @return the {@link Consumer} to populate the attributes
67+
*/
68+
public static Consumer<Map<String, Object>> principal(String principalName) {
69+
Assert.hasText(principalName, "principalName cannot be empty");
70+
Authentication principal = createAuthentication(principalName);
71+
return (attributes) -> attributes.put(PRINCIPAL_ATTR_NAME, principal);
72+
}
73+
74+
private static Authentication createAuthentication(String principalName) {
75+
return new AbstractAuthenticationToken(Collections.emptySet()) {
76+
@Override
77+
public Object getPrincipal() {
78+
return principalName;
79+
}
80+
81+
@Override
82+
public Object getCredentials() {
83+
return null;
84+
}
85+
};
86+
}
87+
88+
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/client/SecurityContextHolderPrincipalResolver.java

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/*
2+
* Copyright 2002-2024 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.oauth2.client.web.client;
18+
19+
import org.springframework.http.HttpRequest;
20+
import org.springframework.security.core.Authentication;
21+
import org.springframework.security.core.context.SecurityContextHolder;
22+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
23+
24+
/**
25+
* A strategy for resolving a {@link Authentication principal} from an intercepted request
26+
* using the {@link SecurityContextHolder}.
27+
*
28+
* @author Steve Riesenberg
29+
* @since 6.4
30+
*/
31+
public class SecurityContextHolderPrincipalResolver implements OAuth2ClientHttpRequestInterceptor.PrincipalResolver {
32+
33+
private final SecurityContextHolderStrategy securityContextHolderStrategy;
34+
35+
/**
36+
* Constructs a {@code SecurityContextHolderPrincipalResolver}.
37+
*/
38+
public SecurityContextHolderPrincipalResolver() {
39+
this(SecurityContextHolder.getContextHolderStrategy());
40+
}
41+
42+
/**
43+
* Constructs a {@code SecurityContextHolderPrincipalResolver} using the provided
44+
* parameters.
45+
* @param securityContextHolderStrategy the {@link SecurityContextHolderStrategy} to
46+
* use for resolving the {@link Authentication principal}
47+
*/
48+
public SecurityContextHolderPrincipalResolver(SecurityContextHolderStrategy securityContextHolderStrategy) {
49+
this.securityContextHolderStrategy = securityContextHolderStrategy;
50+
}
51+
52+
@Override
53+
public Authentication resolve(HttpRequest request) {
54+
return this.securityContextHolderStrategy.getContext().getAuthentication();
55+
}
56+
57+
}

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/client/OAuth2ClientHttpRequestInterceptorTests.java

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@
4343
import org.springframework.security.core.authority.AuthorityUtils;
4444
import org.springframework.security.core.context.SecurityContext;
4545
import org.springframework.security.core.context.SecurityContextHolder;
46-
import org.springframework.security.core.context.SecurityContextHolderStrategy;
4746
import org.springframework.security.core.context.SecurityContextImpl;
4847
import org.springframework.security.oauth2.client.ClientAuthorizationException;
4948
import org.springframework.security.oauth2.client.OAuth2AuthorizationFailureHandler;
@@ -110,15 +109,15 @@ public class OAuth2ClientHttpRequestInterceptorTests {
110109
@Mock
111110
private OAuth2AuthorizedClientRepository authorizedClientRepository;
112111

113-
@Mock
114-
private SecurityContextHolderStrategy securityContextHolderStrategy;
115-
116112
@Mock
117113
private OAuth2AuthorizedClientService authorizedClientService;
118114

119115
@Mock
120116
private OAuth2ClientHttpRequestInterceptor.ClientRegistrationIdResolver clientRegistrationIdResolver;
121117

118+
@Mock
119+
private OAuth2ClientHttpRequestInterceptor.PrincipalResolver principalResolver;
120+
122121
@Captor
123122
private ArgumentCaptor<OAuth2AuthorizeRequest> authorizeRequestCaptor;
124123

@@ -167,13 +166,6 @@ public void constructorWhenAuthorizedClientManagerIsNullThenThrowsIllegalArgumen
167166
.withMessage("authorizedClientManager cannot be null");
168167
}
169168

170-
@Test
171-
public void constructorWhenClientRegistrationIdResolverIsNullThenThrowsIllegalArgumentException() {
172-
assertThatIllegalArgumentException()
173-
.isThrownBy(() -> new OAuth2ClientHttpRequestInterceptor(this.authorizedClientManager, null))
174-
.withMessage("clientRegistrationIdResolver cannot be null");
175-
}
176-
177169
@Test
178170
public void setAuthorizationFailureHandlerWhenNullThenThrowsIllegalArgumentException() {
179171
assertThatIllegalArgumentException()
@@ -198,10 +190,16 @@ public void authorizationFailureHandlerWhenAuthorizedClientServiceIsNullThenThro
198190
}
199191

200192
@Test
201-
public void setSecurityContextHolderStrategyWhenNullThenThrowsIllegalArgumentException() {
193+
public void setClientRegistrationIdResolverWhenNullThenThrowsIllegalArgumentException() {
202194
assertThatIllegalArgumentException()
203-
.isThrownBy(() -> this.requestInterceptor.setSecurityContextHolderStrategy(null))
204-
.withMessage("securityContextHolderStrategy cannot be null");
195+
.isThrownBy(() -> this.requestInterceptor.setClientRegistrationIdResolver(null))
196+
.withMessage("clientRegistrationIdResolver cannot be null");
197+
}
198+
199+
@Test
200+
public void setPrincipalResolverWhenNullThenThrowsIllegalArgumentException() {
201+
assertThatIllegalArgumentException().isThrownBy(() -> this.requestInterceptor.setPrincipalResolver(null))
202+
.withMessage("principalResolver cannot be null");
205203
}
206204

207205
@Test
@@ -605,8 +603,7 @@ public void interceptWhenUnauthorizedAndAuthorizationFailureHandlerSetWithAuthor
605603

606604
@Test
607605
public void interceptWhenCustomClientRegistrationIdResolverSetThenUsed() {
608-
this.requestInterceptor = new OAuth2ClientHttpRequestInterceptor(this.authorizedClientManager,
609-
this.clientRegistrationIdResolver);
606+
this.requestInterceptor.setClientRegistrationIdResolver(this.clientRegistrationIdResolver);
610607
this.requestInterceptor.setAuthorizationFailureHandler(this.authorizationFailureHandler);
611608
given(this.authorizedClientManager.authorize(any(OAuth2AuthorizeRequest.class)))
612609
.willReturn(this.authorizedClient);
@@ -625,31 +622,29 @@ public void interceptWhenCustomClientRegistrationIdResolverSetThenUsed() {
625622
this.server.verify();
626623
verify(this.authorizedClientManager).authorize(this.authorizeRequestCaptor.capture());
627624
verify(this.clientRegistrationIdResolver).resolve(any(HttpRequest.class));
628-
verifyNoMoreInteractions(this.clientRegistrationIdResolver, this.authorizedClientManager);
625+
verifyNoMoreInteractions(this.authorizedClientManager, this.clientRegistrationIdResolver);
629626
verifyNoInteractions(this.authorizationFailureHandler);
630627
OAuth2AuthorizeRequest authorizeRequest = this.authorizeRequestCaptor.getValue();
631628
assertThat(authorizeRequest.getClientRegistrationId()).isEqualTo(clientRegistrationId);
632629
assertThat(authorizeRequest.getPrincipal()).isEqualTo(this.principal);
633630
}
634631

635632
@Test
636-
public void interceptWhenCustomSecurityContextHolderStrategySetThenUsed() {
637-
this.requestInterceptor.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
633+
public void interceptWhenCustomPrincipalResolverSetThenUsed() {
634+
this.requestInterceptor.setPrincipalResolver(this.principalResolver);
638635
given(this.authorizedClientManager.authorize(any(OAuth2AuthorizeRequest.class)))
639636
.willReturn(this.authorizedClient);
640637

641638
bindToRestClient(withRequestInterceptor());
642639
this.server.expect(requestTo(REQUEST_URI))
643640
.andExpect(hasAuthorizationHeader(this.authorizedClient.getAccessToken()))
644641
.andRespond(withApplicationJson());
645-
SecurityContext securityContext = new SecurityContextImpl();
646-
securityContext.setAuthentication(this.principal);
647-
given(this.securityContextHolderStrategy.getContext()).willReturn(securityContext);
642+
given(this.principalResolver.resolve(any(HttpRequest.class))).willReturn(this.principal);
648643
performRequest(withClientRegistrationId());
649644
this.server.verify();
650645
verify(this.authorizedClientManager).authorize(this.authorizeRequestCaptor.capture());
651-
verify(this.securityContextHolderStrategy).getContext();
652-
verifyNoMoreInteractions(this.authorizedClientManager, this.securityContextHolderStrategy);
646+
verify(this.principalResolver).resolve(any(HttpRequest.class));
647+
verifyNoMoreInteractions(this.authorizedClientManager, this.principalResolver);
653648
OAuth2AuthorizeRequest authorizeRequest = this.authorizeRequestCaptor.getValue();
654649
assertThat(authorizeRequest.getClientRegistrationId()).isEqualTo(this.clientRegistration.getRegistrationId());
655650
assertThat(authorizeRequest.getPrincipal()).isEqualTo(this.principal);

0 commit comments

Comments
 (0)