Support grant types other than authorization_code

Closes spring-projectsgh-9795

Author: Steve Riesenberg

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.java

@@ -23,6 +23,7 @@
 import java.util.Map;
 import java.util.function.Supplier;
 
+import com.nimbusds.oauth2.sdk.GrantType;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.as.AuthorizationServerMetadata;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -239,23 +240,51 @@ private static ClientRegistration.Builder withProviderConfiguration(Authorizatio
 				() -> "The Issuer \"" + metadataIssuer + "\" provided in the configuration metadata did "
 						+ "not match the requested issuer \"" + issuer + "\"");
 		String name = URI.create(issuer).getHost();
+		AuthorizationGrantType grantType = getAuthorizationGrantType(metadata.getGrantTypes());
 		ClientAuthenticationMethod method = getClientAuthenticationMethod(issuer,
 				metadata.getTokenEndpointAuthMethods());
 		Map<String, Object> configurationMetadata = new LinkedHashMap<>(metadata.toJSONObject());
 		// @formatter:off
 		return ClientRegistration.withRegistrationId(name)
 				.userNameAttributeName(IdTokenClaimNames.SUB)
-				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+				.authorizationGrantType(grantType)
 				.clientAuthenticationMethod(method)
 				.redirectUri("{baseUrl}/{action}/oauth2/code/{registrationId}")
-				.authorizationUri(metadata.getAuthorizationEndpointURI().toASCIIString())
+				.authorizationUri((metadata.getAuthorizationEndpointURI() != null) ? metadata
+						.getAuthorizationEndpointURI().toASCIIString() : null)
 				.providerConfigurationMetadata(configurationMetadata)
 				.tokenUri(metadata.getTokenEndpointURI().toASCIIString())
 				.issuerUri(issuer)
 				.clientName(issuer);
 		// @formatter:on
 	}
 
+	private static AuthorizationGrantType getAuthorizationGrantType(List<GrantType> metadataGrantTypes) {
+		if (metadataGrantTypes == null || metadataGrantTypes.size() > 1) {
+			return AuthorizationGrantType.AUTHORIZATION_CODE;
+		}
+		GrantType grantType = metadataGrantTypes.get(0);
+		if (GrantType.AUTHORIZATION_CODE.equals(grantType)) {
+			return AuthorizationGrantType.AUTHORIZATION_CODE;
+		}
+		else if (GrantType.IMPLICIT.equals(grantType)) {
+			return AuthorizationGrantType.IMPLICIT;
+		}
+		else if (GrantType.REFRESH_TOKEN.equals(grantType)) {
+			return AuthorizationGrantType.REFRESH_TOKEN;
+		}
+		else if (GrantType.CLIENT_CREDENTIALS.equals(grantType)) {
+			return AuthorizationGrantType.CLIENT_CREDENTIALS;
+		}
+		else if (GrantType.PASSWORD.equals(grantType)) {
+			return AuthorizationGrantType.PASSWORD;
+		}
+		else if (GrantType.JWT_BEARER.equals(grantType)) {
+			return AuthorizationGrantType.JWT_BEARER;
+		}
+		return new AuthorizationGrantType(grantType.getValue());
+	}
+
 	private static ClientAuthenticationMethod getClientAuthenticationMethod(String issuer,
 			List<com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod> metadataAuthMethods) {
 		if (metadataAuthMethods == null || metadataAuthMethods

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/registration/ClientRegistrationsTests.java

@@ -240,22 +240,72 @@ public void issuerWhenOAuth2GrantTypesSupportedNullThenDefaulted() throws Except
 		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
 	}
 
+	// gh-9795
+	@Test
+	public void issuerWhenMultipleGrantTypesThenDefaulted() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("client_credentials", "password"));
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
+	}
+
 	// gh-9828
 	@Test
 	public void issuerWhenImplicitGrantTypeThenSuccess() throws Exception {
 		this.response.put("grant_types_supported", Arrays.asList("implicit"));
 		ClientRegistration registration = registration("").build();
-		// The authorization_code grant type is still the default
-		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.IMPLICIT);
+	}
+
+	// gh-9795
+	@Test
+	public void issuerWhenRefreshTokenGrantTypeThenSuccess() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("refresh_token"));
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.REFRESH_TOKEN);
+	}
+
+	// gh-9795
+	@Test
+	public void issuerWhenClientCredentialsGrantTypeThenSuccess() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("client_credentials"));
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.CLIENT_CREDENTIALS);
+	}
+
+	// gh-9795
+	@Test
+	public void issuerWhenPasswordGrantTypeThenSuccess() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("password"));
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.PASSWORD);
 	}
 
 	// gh-9828
 	@Test
 	public void issuerWhenOAuth2JwtBearerGrantTypeThenSuccess() throws Exception {
 		this.response.put("grant_types_supported", Arrays.asList("urn:ietf:params:oauth:grant-type:jwt-bearer"));
 		ClientRegistration registration = registrationOAuth2("", null).build();
-		// The authorization_code grant type is still the default
-		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.AUTHORIZATION_CODE);
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.JWT_BEARER);
+	}
+
+	// gh-9795
+	@Test
+	public void issuerWhenSaml2BearerGrantTypeThenSuccess() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("urn:ietf:params:oauth:grant-type:saml2-bearer"));
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType().getValue())
+				.isEqualTo("urn:ietf:params:oauth:grant-type:saml2-bearer");
+	}
+
+	// gh-9795
+	@Test
+	public void issuerWhenResponseAuthorizationEndpointIsNullThenSuccess() throws Exception {
+		this.response.put("grant_types_supported", Arrays.asList("urn:ietf:params:oauth:grant-type:jwt-bearer"));
+		this.response.remove("authorization_endpoint");
+		ClientRegistration registration = registration("").build();
+		assertThat(registration.getAuthorizationGrantType()).isEqualTo(AuthorizationGrantType.JWT_BEARER);
+		ClientRegistration.ProviderDetails provider = registration.getProviderDetails();
+		assertThat(provider.getAuthorizationUri()).isNull();
 	}
 
 	@Test