Extract the ID Token JwtDecoderFactory to enable user customization #6415

raphaelDL · 2019-01-11T15:19:17Z

This commit ensures that the JwtDecoder is not a private field inside
the Oidc authentication provider by extracting this class and giving the
possibility to customize the way different providers are validated.

Fixes: gh-6379

jgrandja

Thanks for the PR @raphaelDL ! Please see my comments inline.

jgrandja · 2019-01-11T16:09:54Z

...rg/springframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactory.java

+ */
+public final class OidcIdTokenDecoderFactory implements JwtDecoderFactory<ClientRegistration> {
+	private final Map<String, JwtDecoder> jwtDecoders = new ConcurrentHashMap<>();
+	private static final String MISSING_SIGNATURE_VERIFIER_ERROR_CODE = "missing_signature_verifier";


Let's move the static members to top of declarations.

jgrandja · 2019-01-11T16:12:25Z

...rg/springframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactory.java

+	 * @param jwtValidatorFactory
+	 */
+	public final void setJwtValidatorFactory(Function<ClientRegistration, OAuth2TokenValidator<Jwt>> jwtValidatorFactory) {
+		this.jwtValidatorFactory = jwtValidatorFactory;


We should Assert.notNull

jgrandja · 2019-01-11T16:16:39Z

...rg/springframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactory.java

+			}
+			String jwkSetUri = clientRegistration.getProviderDetails().getJwkSetUri();
+			NimbusJwtDecoder jwtDecoder = new NimbusJwtDecoder(withJwkSetUri(jwkSetUri).build());
+			OAuth2TokenValidator<Jwt> jwtValidator = new DelegatingOAuth2TokenValidator<>(jwtValidatorFactory.apply(clientRegistration));


We don't need to use DelegatingOAuth2TokenValidator given that we're directly assigning the one returned instance.

jgrandja · 2019-01-11T16:28:12Z

...gframework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactory.java

+ * @see OAuth2TokenValidator
+ * @see Jwt
+ */
+public class ReactiveOidcIdTokenDecoderFactory implements ReactiveJwtDecoderFactory<ClientRegistration> {


Please make class final

jgrandja · 2019-01-11T16:28:23Z

...gframework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactory.java

+ */
+public class ReactiveOidcIdTokenDecoderFactory implements ReactiveJwtDecoderFactory<ClientRegistration> {
+	private final Map<String, ReactiveJwtDecoder> jwtDecoders = new ConcurrentHashMap<>();
+	private static final String MISSING_SIGNATURE_VERIFIER_ERROR_CODE = "missing_signature_verifier";


Let's move the static members to top of declarations.

jgrandja · 2019-01-11T16:52:26Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+	}
+
+	@Test
+	public void createWhenWithCustomDecoderTheSuccess() {


I don't think this test makes sense. It's pretty much the same as above test. Please remove it.

jgrandja · 2019-01-11T16:56:23Z

...rg/springframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactory.java

+
+	@Override
+	public JwtDecoder createDecoder(ClientRegistration clientRegistration) {
+		return this.jwtDecoders.computeIfAbsent(clientRegistration.getRegistrationId(), key -> {


We should Assert.notNull on clientRegistration

jgrandja · 2019-01-11T16:56:42Z

...gframework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactory.java

+
+	@Override
+	public ReactiveJwtDecoder createDecoder(ClientRegistration clientRegistration) {
+		return this.jwtDecoders.computeIfAbsent(clientRegistration.getRegistrationId(), key -> {


We should Assert.notNull on clientRegistration

jgrandja · 2019-01-11T17:13:48Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+		}
+		return idTokenValidator;
+	};
+}


I feel that the only tests we need here are as follows:

setJwtValidatorFactoryWhenNullThenThrowIllegalArgumentException

createDecoderWhenClientRegistrationNullThenThrowIllegalArgumentException

createDecoderWhenJwkSetUriEmptyThenThrowOAuth2AuthenticationException

createDecoderWhenClientRegistrationValidThenReturnDecoder

createDecoderWhenCustomJwtValidatorFactorySetThenApplied

Can you please add these tests? Please let me know if you need any clarification.

Thank you very much, I've submitted the changes

jgrandja · 2019-01-11T17:16:42Z

...ework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactoryTests.java

+ * @author Rafael Dominguez
+ * @since 5.2
+ */
+public class ReactiveOidcIdTokenDecoderFactoryTests {


Same comments apply from OidcIdTokenDecoderFactoryTests

jgrandja

Thanks for the updates. Almost there....some more changes in tests.

jgrandja · 2019-01-11T21:18:18Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+	}
+
+	@Test
+	public void createDecoderWhenCustomJwtValidatorFactorySetThenApplied(){


This is not testing that the custom JwtValidatorFactory is actually called. We need to verify that Function.apply() is actually called. For an example, see NimbusReactiveJwtDecoderTests.decodeWhenUsingSignedJwtThenReturnsClaimsGivenByClaimSetConverter. That test mock(Converter.class) and than verify(claimSetConverter).convert(any(Map.class)). You will need to do the same for Function. Make sense?

Yes, I'm working on it

How's it coming along. Do you need any help?

I've submitted the changes, I don't know why they are not reflected here 🤔

jgrandja · 2019-01-11T21:19:49Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+		assertThat(jwtDecoder).isNotNull();
+	}
+
+	@Test(expected =  IllegalArgumentException.class)


Our preferred method of testing a thrown exception is assertThatThrownBy(). Let's remove expected = IllegalArgumentException.class for all test cases and use assertThatThrownBy() instead.

jgrandja · 2019-01-11T21:20:41Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+	}
+
+	@Test
+	public void createDecoderWhenDefaultJwtValidatorFactorySetThenApplied() {


Please remove this test - createDecoderWhenCustomJwtValidatorFactorySetThenApplied is the main thing we need to test.

jgrandja · 2019-01-11T21:22:01Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+	@Test(expected =  IllegalArgumentException.class)
+	public void setJwtValidatorFactoryWhenNullThenThrowIllegalArgumentException(){
+		idTokenDecoderFactory.setJwtValidatorFactory(null);
+		idTokenDecoderFactory.createDecoder(registration.build());


Please remove this line as it will never get called

jgrandja · 2019-01-11T21:27:43Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+
+	private OidcIdTokenDecoderFactory idTokenDecoderFactory;
+
+	private JwtDecoder jwtDecoder;


Can we remove this and just create it in each test?

jgrandja · 2019-01-11T21:28:01Z

...ework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactoryTests.java

+
+	private ReactiveOidcIdTokenDecoderFactory idTokenDecoderFactory;
+
+	private ReactiveJwtDecoder reactiveJwtDecoder;


Can we remove this and just create it in each test?

This commit ensures that the JwtDecoder is not a private field inside the Oidc authentication provider by extracting this class and giving the possibility to customize the way different providers are validated. Fixes: spring-projectsgh-6379

raphaelDL · 2019-01-14T15:55:01Z

...ringframework/security/oauth2/client/oidc/authentication/OidcIdTokenDecoderFactoryTests.java

+
+		when(customValidator.apply(any(ClientRegistration.class)))
+				.thenReturn(customJwtValidatorFactory.apply(registration.build()));
+


@jgrandja here are the changes, I think they are not reflected because the comment is in the method signature

jgrandja · 2019-01-14T18:39:45Z

Thanks @raphaelDL for getting this done before tomorrow's release. This is now in master! I added a polish commit for some minor updates to the tests and javadoc.

raphaelDL force-pushed the gh-6379 branch from 93e7fc8 to 7f60e48 Compare January 11, 2019 15:34

jgrandja self-assigned this Jan 11, 2019

jgrandja changed the title ~~Extracts the JwTDecoder to enable users customize its behavior~~ Extracts the ID Token JwtDecoderFactory to enable user customization Jan 11, 2019

jgrandja changed the title ~~Extracts the ID Token JwtDecoderFactory to enable user customization~~ Extract the ID Token JwtDecoderFactory to enable user customization Jan 11, 2019

jgrandja requested changes Jan 11, 2019

View reviewed changes

raphaelDL force-pushed the gh-6379 branch 4 times, most recently from d5b48d0 to 9918402 Compare January 11, 2019 18:27

jgrandja requested changes Jan 11, 2019

View reviewed changes

raphaelDL force-pushed the gh-6379 branch from 9918402 to 1090568 Compare January 11, 2019 22:57

raphaelDL force-pushed the gh-6379 branch from 1090568 to 0947e17 Compare January 14, 2019 05:08

raphaelDL commented Jan 14, 2019

View reviewed changes

jgrandja added New Feature in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) labels Jan 14, 2019

jgrandja added this to the 5.2.0.M1 milestone Jan 14, 2019

jgrandja added a commit that referenced this pull request Jan 14, 2019

Polish gh-6415

2a86799

jgrandja approved these changes Jan 14, 2019

View reviewed changes

jgrandja closed this Jan 14, 2019

rwinch added the type: enhancement A general enhancement label May 3, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Extract the ID Token JwtDecoderFactory to enable user customization #6415

Extract the ID Token JwtDecoderFactory to enable user customization #6415

raphaelDL commented Jan 11, 2019

jgrandja left a comment

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

raphaelDL Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja left a comment

jgrandja Jan 11, 2019

raphaelDL Jan 11, 2019

jgrandja Jan 14, 2019

raphaelDL Jan 14, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

jgrandja Jan 11, 2019

raphaelDL Jan 14, 2019

jgrandja commented Jan 14, 2019


		private OidcIdTokenDecoderFactory idTokenDecoderFactory;

		private JwtDecoder jwtDecoder;


		private ReactiveOidcIdTokenDecoderFactory idTokenDecoderFactory;

		private ReactiveJwtDecoder reactiveJwtDecoder;


		when(customValidator.apply(any(ClientRegistration.class)))
		.thenReturn(customJwtValidatorFactory.apply(registration.build()));

Extract the ID Token JwtDecoderFactory to enable user customization #6415

Extract the ID Token JwtDecoderFactory to enable user customization #6415

Conversation

raphaelDL commented Jan 11, 2019

jgrandja left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jgrandja left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jgrandja commented Jan 14, 2019