1
0
mirror of synced 2026-08-04 09:17:02 +00:00

66 Commits

Author SHA1 Message Date
Joe Grandja dce01c5701 Merge branch '7.0.x' 2026-05-28 11:09:59 -04:00
Joe Grandja e4a78c26d6 Polish redirect flows 2026-05-28 10:25:03 -04:00
Josh Cummings 53bc6a7796 Fix Formatting
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-04-20 13:52:41 -06:00
Josh Cummings aed95aa2b1 Fix Formatting
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-04-20 13:45:45 -06:00
Josh Cummings 71abbb2ea8 Fix Checkstyle
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-04-20 11:11:40 -06:00
Josh Cummings f77e35e8cc Merge remote-tracking branch 'origin/main' into main 2026-04-20 10:22:58 -06:00
Josh Cummings 40b074580c Merge branch '7.0.x' into main 2026-04-20 10:21:19 -06:00
Joe Grandja 5c6696ceab Merge branch '7.0.x' 2026-04-18 04:34:41 -04:00
addcontent 19b3cae62e Add authentication validator for dynamic client registration
Signed-off-by: Kelvin Mbogo <addcontent08@gmail.com>
2026-04-17 17:22:40 -04:00
Joe Grandja f66fb0814b Fix merge 2026-04-07 16:12:34 -04:00
Joe Grandja 3008848158 Merge branch '7.0.x' 2026-04-07 15:47:01 -04:00
Joe Grandja 41524880c6 Fix auth_time claim should represent authentication time
Closes gh-18282
2026-04-07 15:44:57 -04:00
Joe Grandja aa35db5aad Fix merge conflict 2026-04-02 05:45:17 -04:00
Josh Cummings cb129d6b2d Merge branch '7.0.x' 2026-03-31 15:56:49 -06:00
Josh Cummings d4678c8e04 Add Missing Serialization Support
Closes gh-19013

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-31 15:55:09 -06:00
Andrey Litvitski 2fda37de53 Fix equals nullability annotations for jspecify compliance
In this commit, we added `@Nullable` to equals methods of classes that
support `jspecify` for consistency with other Spring projects and to
avoid bugs that caused other Spring projects to do this natively.

Closes: gh-18929, gh-18927

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2026-03-23 09:25:57 -06:00
Joe Grandja 1db0d4f83d Enable null-safety in spring-security-oauth2-authorization-server
Closes gh-18937
2026-03-23 05:07:14 -04:00
Joe Grandja 703ffaf143 Merge branch '7.0.x' 2026-03-10 15:59:29 -04:00
Joe Grandja 1906075b0c OAuth2DeviceVerificationEndpointFilter is applied after AuthorizationFilter
Closes gh-18873
2026-03-10 15:32:24 -04:00
Joe Grandja c7235ec0a3 Allow custom token settings for OAuth 2.0 dynamic client registration
Closes gh-18870
2026-03-10 07:48:37 -04:00
Robert Winch 2eb948d9b5 Ensure tests clear AuthorizationServerContextHolder
Closes gh-18768
2026-02-23 08:17:02 -06:00
Robert Winch 0dc1aa1126 Ensure tests clear AuthorizationServerContextHolder 2026-02-19 15:20:44 -06:00
gimgisu 46027974dd @gisu1102
Apply code formatting to OAuth2AuthorizationServerBeanRegistrationAotProcessor

Closes spring-projectsgh-18432

Signed-off-by: gimgisu <gisu1102@gmail.com>
2026-02-02 19:27:44 -06:00
gimgisu 338786bab9 @gisu1102
Align AOT hints with MemberCategory deprecation replacements

- Replace DECLARED_FIELDS with ACCESS_DECLARED_FIELDS in runtime hints

- Preserve 1:1 intent for Collections via registerType only

- Keep INVOKE_* only where it existed before

Closes spring-projectsgh-18432

Signed-off-by: gimgisu <gisu1102@gmail.com>
2026-02-02 19:27:44 -06:00
gimgisu d7ecb8fdcf @gisu1102
Restore Jackson 2 module runtime hints for passivity

- Keep Jackson 2 module registrations when jackson2 is present

- Extract Jackson 2 hint registration into a dedicated method

- Suppress removal warnings only for the Jackson 2 registration

Closes spring-projectsgh-18432

Signed-off-by: gimgisu <gisu1102@gmail.com>
2026-02-02 19:27:44 -06:00
gimgisu a9f9eba6ca @gisu1102
Remove compiler warnings in spring-security-oauth2-authorization-server

- Remove ACCESS_DECLARED_FIELDS from AOT/runtime hints
- Add @SuppressWarnings("removal") for Jackson2 deprecated adapters

Closes spring-projectsgh-18432

Signed-off-by: gimgisu <gisu1102@gmail.com>
2026-02-02 19:27:44 -06:00
Tran Ngoc Nhan 5b7c4ae8d8 Add javadoc-warnings-error
Closes gh-18459

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2026-02-02 11:39:38 -06:00
Joe Grandja 29b9dc6f04 Register runtime hints for authorization server
Issue gh-18251
2025-12-04 15:30:39 -05:00
Joe Grandja c53e66a217 OAuth2AuthorizationEndpointFilter is applied after AuthorizationFilter
Closes gh-18251
2025-12-02 08:49:49 -05:00
Joe Grandja 5fb2875f47 AOT hints for authorization server Jackson 3 types should be registered
Closes gh-18146
2025-11-06 10:14:00 -05:00
Joe Grandja 27ae318992 JdbcRegisteredClientRepository should support Jackson 3
Issue gh-17832

Closes gh-18143
2025-11-05 15:27:14 -05:00
Joe Grandja 73840663b9 Polish JdbcOAuth2AuthorizationService 2025-11-05 06:41:41 -05:00
Joe Grandja e6b4d461e7 Fix OAuth2AuthorizationServerJacksonModule type validator configuration
Closes gh-18102
2025-10-30 07:19:45 -04:00
Joe Grandja 90855aa128 Missing response_type in POST authorization request returns invalid_request
Issue https://github.com/spring-projects/spring-authorization-server/issues/2226
2025-10-24 05:55:45 -04:00
Joe Grandja 22cbb13f7d Add comments to SQL-scripts to ensure robust timezone handling
Issue https://github.com/spring-projects/spring-authorization-server/pull/2217
2025-10-20 07:12:50 -04:00
Joe Grandja fc8b6b5863 Return PAR endpoint metadata only when enabled
Issue https://github.com/spring-projects/spring-authorization-server/issues/2219
2025-10-20 06:06:24 -04:00
Rob Winch a181733365 Encapsulate GenericHttpMessageConverterAdapter
This will allow its removal in gh-18073
2025-10-19 17:03:19 -05:00
Rob Winch 5e851e0b26 Remove JdbcOAuth2AuthorizationService.Mapper
- We should not introduce an unnecessary public API
  - It would need to be removed when Jackson 2 support was removed, but
    was required to configure Jackson 3 support
  - There are already existing interfaces that could be used
- OAuth2AuthorizationRowMapper & OAuth2AuthorizationParametersMapper had
  unnecessary breaking changes by removing getter/setter for ObjectMapper
- To prevent NoClassDefFoundErrors all optional (Jackson) dependencies
  need to be on different classes & we wish to preserve the existing
  accessors for ObjectMapper which is this uses subclasses
- With added TestAuthenticationTokenMixin support, no need to explicitly
  add it in tests
2025-10-19 17:03:19 -05:00
Rob Winch 803936cfbe JacksonDelegate uses SecurityJacksonModules 2025-10-19 17:03:19 -05:00
Rob Winch 50568da1e5 Add Jackson 3 TestingAuthenticationToken Support
Without this many of the tests fail when using Jackson 3
2025-10-19 17:03:19 -05:00
Sébastien Deleuze 137f8fd670 Add support for JacksonJsonHttpMessageConverter
This commit introduces classpath checks and instantiation of
JacksonJsonHttpMessageConverter (based on Jackson 3) leveraging
a new GenericHttpMessageConverterAdapter which allows to adapt
SmartHttpMessageConverter to GenericHttpMessageConverter.

See gh-17832
Signed-off-by: Sébastien Deleuze <sdeleuze@users.noreply.github.com>
2025-10-19 17:03:19 -05:00
Sébastien Deleuze 48854c3ac9 Deprecate Jackson 2 support
This commit does not cover webauthn which is a special case (uses
jackson sub-package for Jackson 2 support) which will be handled in
a distinct commit.

See gh-17832
Signed-off-by: Sébastien Deleuze <sdeleuze@users.noreply.github.com>
2025-10-19 17:03:19 -05:00
Sébastien Deleuze 65a14d6c6d Add Jackson 3 support
This commit adds support for Jackson 3 which has the following
major differences with the Jackson 2 one:
 - jackson subpackage instead of jackson2
 - Jackson type prefix instead of Jackson2
 - JsonMapper instead of ObjectMapper
 - For configuration, JsonMapper.Builder instead of ObjectMapper
   since the latter is now immutable
 - Remove custom support for unmodifiable collections
 - Use safe default typing via a PolymorphicTypeValidator

Jackson 3 changes compared to Jackson 2 are documented in
https://cowtowncoder.medium.com/jackson-3-0-0-ga-released-1f669cda529a
and
https://github.com/FasterXML/jackson/blob/main/jackson3/MIGRATING_TO_JACKSON_3.md.

This commit does not cover webauthn which is a special case (uses
jackson sub-package for Jackson 2 support) which will be handled in
a distinct commit.

See gh-17832
Signed-off-by: Sébastien Deleuze <sdeleuze@users.noreply.github.com>
2025-10-19 17:03:19 -05:00
Joe Grandja fc795a81d4 PAR uses requested scopes on consent
Issue https://github.com/spring-projects/spring-authorization-server/pull/2182
2025-10-17 16:14:31 -04:00
Joe Grandja 4b810a8971 Disallow usage of the openid scope in device authorization requests
Issue https://github.com/spring-projects/spring-authorization-server/pull/2177
2025-10-17 11:41:30 -04:00
Joe Grandja 586081c125 Revert "Temporarily fix integration tests"
This reverts commit 35f41f87d1.

Issue gh-17880
2025-10-10 13:33:42 -04:00
Joe Grandja 1213dbe76f Fix checkstyle 2025-10-09 13:51:50 -04:00
Joe Grandja 3656e7ad8c Add tests to OAuth2AuthorizationServerJackson2ModuleTests 2025-10-09 13:23:38 -04:00
Joe Grandja 1cca9c5822 Enable PKCE by default in authorization server
Closes gh-18020
2025-10-09 09:51:17 -04:00
Joe Grandja 469ed09645 Allow setting Clock in OAuth2TokenGenerator implementations
Closes gh-18017
2025-10-07 16:34:43 -04:00