spring-projects / spring-projects/spring-security

Allow setting Oauth 2.0 Resource Indicators in Oauth client calls

Open
#16,605 3 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

Allow the setting of Resource Indicators for Oauth 2.0 on ClientRegistration to then be used for authentication requests.

Current Behavior

The current process for setting an RFC 8707 resource indicator might appear to be begin with either

  1. Implementing a custom Oauth2AuthorizedClientManager and in the authorize method adding the indicator as a custom attribute entry to the Oauth2AuthorizationContext.
  2. Instantiating an existing Oauth2AuthorizedClientManager implementation and setting a contextAttributesMapper on that instance that would create the resource indicator entry.

However, it seems that this value would ultimately not be applied by a parametersConverter such as the OAuth2ClientCredentialsGrantRequestEntityConverter, so quite a bit more custom work appears to be necessary.

Context

My specific case involves a client credentials flow involving a resource indicator rather than core oauth 2 scopes, using WebClient and a ServletOAuth2AuthorizedClientExchangeFilterFunction. I'm also leveraging spring-boot oauth client autoconfiguration properties, but as that project's property values are applied to spring-security ClientRegistrations starting here seems to make the most sense.

The only existing issues involving resource indicators that I'm aware of are this project's #6972 and the spring-authorization-server project's support request.

Are there any other workarounds that I'm unaware of?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ClientRegistration and trace how OAuth2AuthorizedClientManager and OAuth2ClientCredentialsGrantRequestEntityConverter build authentication requests. Check the WebClient and ServletOAuth2AuthorizedClientExchangeFilterFunction flow described in the issue; done means a resource indicator configured on ClientRegistration is included in the OAuth client request without custom manager work.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.