Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate OpenID 2.0 support

Browse Source 
Deprecate OpenID 2.0 support
This commit is contained in:
Rob Winch
2020-05-12 09:37:56 -05:00
committed by GitHub
parent cd08102b93 f2a2b469c4
commit e5d2aaf6fe
37 changed files with 200 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
+6 -1
View File
@@ -233,7 +233,9 @@ public final class HttpSecurity extends
* </pre>
*
* @return the {@link OpenIDLoginConfigurer} for further customizations.
*
* @deprecated The OpenID 1.0 and 2.0 protocols have been deprecated and users are
* <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a>
* to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
* @throws Exception
* @see OpenIDLoginConfigurer
*/
@@ -355,6 +357,9 @@ public final class HttpSecurity extends
*
* @param openidLoginCustomizer the {@link Customizer} to provide more options for
* the {@link OpenIDLoginConfigurer}
* @deprecated The OpenID 1.0 and 2.0 protocols have been deprecated and users are
* <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a>
* to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
* @return the {@link HttpSecurity} for further customizations
* @throws Exception
*/
config/src/main/java/org/springframework/security/config/annotation/web/configurers/openid/OpenIDLoginConfigurer.java
+3
View File
@@ -118,6 +118,9 @@ import org.springframework.security.web.util.matcher.RequestMatcher;
* </ul>
*
* @author Rob Winch
* @deprecated The OpenID 1.0 and 2.0 protocols have been deprecated and users are
* <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a>
* to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
* @since 3.2
*/
public final class OpenIDLoginConfigurer<H extends HttpSecurityBuilder<H>> extends
config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
+60 -45
View File
@@ -350,51 +350,7 @@ final class AuthenticationConfigBuilder {
RootBeanDefinition openIDFilter = null;
if (openIDLoginElt != null) {
FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser(
"/login/openid", null,
OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache,
sessionStrategy, allowSessionCreation, portMapper, portResolver);
parser.parse(openIDLoginElt, pc);
openIDFilter = parser.getFilterBean();
openIDEntryPoint = parser.getEntryPointBean();
openidLoginProcessingUrl = parser.getLoginProcessingUrl();
openIDLoginPage = parser.getLoginPage();
List<Element> attrExElts = DomUtils.getChildElementsByTagName(openIDLoginElt,
Elements.OPENID_ATTRIBUTE_EXCHANGE);
if (!attrExElts.isEmpty()) {
// Set up the consumer with the required attribute list
BeanDefinitionBuilder consumerBldr = BeanDefinitionBuilder
.rootBeanDefinition(OPEN_ID_CONSUMER_CLASS);
BeanDefinitionBuilder axFactory = BeanDefinitionBuilder
.rootBeanDefinition(OPEN_ID_ATTRIBUTE_FACTORY_CLASS);
ManagedMap<String, ManagedList<BeanDefinition>> axMap = new ManagedMap<>();
for (Element attrExElt : attrExElts) {
String identifierMatch = attrExElt.getAttribute("identifier-match");
if (!StringUtils.hasText(identifierMatch)) {
if (attrExElts.size() > 1) {
pc.getReaderContext().error(
"You must supply an identifier-match attribute if using more"
+ " than one "
+ Elements.OPENID_ATTRIBUTE_EXCHANGE
+ " element", attrExElt);
}
// Match anything
identifierMatch = ".*";
}
axMap.put(identifierMatch, parseOpenIDAttributes(attrExElt));
}
axFactory.addConstructorArgValue(axMap);
consumerBldr.addConstructorArgValue(axFactory.getBeanDefinition());
openIDFilter.getPropertyValues().addPropertyValue("consumer",
consumerBldr.getBeanDefinition());
}
openIDFilter = parseOpenIDFilter(sessionStrategy, openIDLoginElt);
}
if (openIDFilter != null) {
@@ -412,6 +368,65 @@ final class AuthenticationConfigBuilder {
}
}
/**
* Parses OpenID 1.0 and 2.0 - related parts of configuration xmls
* @deprecated The OpenID 1.0 and 2.0 protocols have been deprecated and users are
* <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a>
* to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
* @param sessionStrategy sessionStrategy
* @param openIDLoginElt the element from the xml file
* @return the parsed filter as rootBeanDefinition
*/
private RootBeanDefinition parseOpenIDFilter( BeanReference sessionStrategy, Element openIDLoginElt ) {
RootBeanDefinition openIDFilter;
FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser(
"/login/openid", null,
OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache,
sessionStrategy, allowSessionCreation, portMapper, portResolver);
parser.parse(openIDLoginElt, pc);
openIDFilter = parser.getFilterBean();
openIDEntryPoint = parser.getEntryPointBean();
openidLoginProcessingUrl = parser.getLoginProcessingUrl();
openIDLoginPage = parser.getLoginPage();
List<Element> attrExElts = DomUtils.getChildElementsByTagName(openIDLoginElt,
Elements.OPENID_ATTRIBUTE_EXCHANGE);
if (!attrExElts.isEmpty()) {
// Set up the consumer with the required attribute list
BeanDefinitionBuilder consumerBldr = BeanDefinitionBuilder
.rootBeanDefinition(OPEN_ID_CONSUMER_CLASS);
BeanDefinitionBuilder axFactory = BeanDefinitionBuilder
.rootBeanDefinition(OPEN_ID_ATTRIBUTE_FACTORY_CLASS);
ManagedMap<String, ManagedList<BeanDefinition>> axMap = new ManagedMap<>();
for (Element attrExElt : attrExElts) {
String identifierMatch = attrExElt.getAttribute("identifier-match");
if (!StringUtils.hasText(identifierMatch)) {
if (attrExElts.size() > 1) {
pc.getReaderContext().error(
"You must supply an identifier-match attribute if using more"
+ " than one "
+ Elements.OPENID_ATTRIBUTE_EXCHANGE
+ " element", attrExElt);
}
// Match anything
identifierMatch = ".*";
}
axMap.put(identifierMatch, parseOpenIDAttributes(attrExElt));
}
axFactory.addConstructorArgValue(axMap);
consumerBldr.addConstructorArgValue(axFactory.getBeanDefinition());
openIDFilter.getPropertyValues().addPropertyValue("consumer",
consumerBldr.getBeanDefinition());
}
return openIDFilter;
}
private ManagedList<BeanDefinition> parseOpenIDAttributes(Element attrExElt) {
ManagedList<BeanDefinition> attributes = new ManagedList<>();
for (Element attElt : DomUtils.getChildElementsByTagName(attrExElt,
config/src/main/resources/org/springframework/security/config/spring-security-5.4.rnc
+2 -2
View File
@@ -615,7 +615,7 @@ opaque-token.attlist &=
attribute introspector-ref {xsd:token}?
openid-login =
## Sets up form login for authentication with an Open ID identity
## Sets up form login for authentication with an Open ID identity. NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a> to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
element openid-login {form-login.attlist, user-service-ref?, attribute-exchange*}
attribute-exchange =
@@ -627,7 +627,7 @@ attribute-exchange.attlist &=
attribute identifier-match {xsd:token}?
openid-attribute =
## Attributes used when making an OpenID AX Fetch Request
## Attributes used when making an OpenID AX Fetch Request. NOTE: The OpenID 1.0 and 2.0 protocols have been deprecated and users are <a href="https://openid.net/specs/openid-connect-migration-1_0.html">encouraged to migrate</a> to <a href="https://openid.net/connect/">OpenID Connect</a>, which is supported by <code>spring-security-oauth2</code>.
element openid-attribute {openid-attribute.attlist}
openid-attribute.attlist &=
config/src/main/resources/org/springframework/security/config/spring-security-5.4.xsd
+10 -2
View File
@@ -960,7 +960,11 @@
<xs:element ref="security:oauth2-resource-server"/>
<xs:element name="openid-login">
<xs:annotation>
<xs:documentation>Sets up form login for authentication with an Open ID identity
<xs:documentation>Sets up form login for authentication with an Open ID identity. NOTE: The OpenID 1.0 and
2.0 protocols have been deprecated and users are &lt;a
href="https://openid.net/specs/openid-connect-migration-1_0.html"&gt;encouraged to
migrate&lt;/a&gt; to &lt;a href="https://openid.net/connect/"&gt;OpenID Connect&lt;/a&gt;, which is
supported by &lt;code&gt;spring-security-oauth2&lt;/code&gt;.
</xs:documentation>
</xs:annotation>
<xs:complexType>
@@ -1905,7 +1909,11 @@
</xs:attributeGroup>
<xs:element name="openid-attribute">
<xs:annotation>
<xs:documentation>Attributes used when making an OpenID AX Fetch Request
<xs:documentation>Attributes used when making an OpenID AX Fetch Request. NOTE: The OpenID 1.0 and 2.0
protocols have been deprecated and users are &lt;a
href="https://openid.net/specs/openid-connect-migration-1_0.html"&gt;encouraged to
migrate&lt;/a&gt; to &lt;a href="https://openid.net/connect/"&gt;OpenID Connect&lt;/a&gt;, which is
supported by &lt;code&gt;spring-security-oauth2&lt;/code&gt;.
</xs:documentation>
</xs:annotation>
<xs:complexType>