spring-projects / spring-projects/spring-security
Allow setting Oauth 2.0 Resource Indicators in Oauth client calls
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Allow the setting of Resource Indicators for Oauth 2.0 on ClientRegistration to then be used for authentication requests.
Current Behavior
The current process for setting an RFC 8707 resource indicator might appear to be begin with either
- Implementing a custom
Oauth2AuthorizedClientManagerand in theauthorizemethod adding the indicator as a custom attribute entry to theOauth2AuthorizationContext. - Instantiating an existing
Oauth2AuthorizedClientManagerimplementation and setting acontextAttributesMapperon that instance that would create the resource indicator entry.
However, it seems that this value would ultimately not be applied by a parametersConverter such as the OAuth2ClientCredentialsGrantRequestEntityConverter, so quite a bit more custom work appears to be necessary.
Context
My specific case involves a client credentials flow involving a resource indicator rather than core oauth 2 scopes, using WebClient and a ServletOAuth2AuthorizedClientExchangeFilterFunction. I'm also leveraging spring-boot oauth client autoconfiguration properties, but as that project's property values are applied to spring-security ClientRegistrations starting here seems to make the most sense.
The only existing issues involving resource indicators that I'm aware of are this project's #6972 and the spring-authorization-server project's support request.
Are there any other workarounds that I'm unaware of?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ClientRegistration and trace how OAuth2AuthorizedClientManager and OAuth2ClientCredentialsGrantRequestEntityConverter build authentication requests. Check the WebClient and ServletOAuth2AuthorizedClientExchangeFilterFunction flow described in the issue; done means a resource indicator configured on ClientRegistration is included in the OAuth client request without custom manager work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100