NimbusJwtDecoder's default RestOperations now respects the JDK's
sun.net.client.defaultConnectTimeout/defaultReadTimeout system properties,
falling back to 30 seconds instead of the previous 500 milliseconds,
matching JwtDecoderProviderConfigurationUtils's existing behavior.
Also documents this default and the RestOperations override in the
reference guide and migration guide (the reference guide's existing
"Configuring Timeouts" section already claimed 30 seconds -- it's been
inaccurate since the 500ms default shipped and is now correct again), and
documents providing a custom JwtDecoderFactory<ClientRegistration> for
OAuth2 Login's ID Token decoding.
Issue gh-19474
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
OAuth2PushedAuthorizationRequestUri uses Base64URL encoding for the state, which can produce a value containing ___, the same sequence used as the delimiter. As a result, indexOf may locate a delimiter within the state instead of the delimiter preceding the expiration timestamp.
Use lastIndexOf to reliably locate the delimiter before the timestamp without changing the existing request URI format.
Closes gh-19444
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
Adds baseline test coverage for OAuth2PushedAuthorizationRequestUri,
which previously had none: a round-trip via create()/parse() and an
explicit parse() case on a hand-constructed request URI.
See gh-19444.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
The deprecated (introspectionUri, clientId, clientSecret) constructors
that the builders replaced explicitly asserted non-null clientId and
clientSecret. Bring the builder's build() in line with that contract by
asserting at the API boundary rather than relying on downstream classes
to enforce it.
Closes gh-19201
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Removed note about DelegatingJwtGrantedAuthoritiesConverter from
ExpressionJwtGrantedAuthoritiesConverter and further explained in
DelegatingJwtGrantedAuthoritiesConverter where it comes in handy.
Issue gh-18300
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This test encodes an JWT with NimbusJwtEncoder, and then decodes it with
NimbusJwtDecoder.
This test will fail when NimbusJwtEncoder emits a JWT with a wrong `typ'
parameter in the header, as NimbusJwtDecoder validates the JWT with
JwtTypeValidator by default. It may be beneficial for finding out other
similiar bugs too.
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
The warning is unnecessary since PKCE only applies to authorization_code
flow and the code already corrects this silently.
Closes: gh-18221
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
- We should not introduce an unnecessary public API
- It would need to be removed when Jackson 2 support was removed, but
was required to configure Jackson 3 support
- There are already existing interfaces that could be used
- OAuth2AuthorizationRowMapper & OAuth2AuthorizationParametersMapper had
unnecessary breaking changes by removing getter/setter for ObjectMapper
- To prevent NoClassDefFoundErrors all optional (Jackson) dependencies
need to be on different classes & we wish to preserve the existing
accessors for ObjectMapper which is this uses subclasses
- With added TestAuthenticationTokenMixin support, no need to explicitly
add it in tests
Joe Grandja