Authorization Code Grant flow should support AccessToken only #4513
Assignees
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
Milestone
Comments
jgrandja
added
the
in: oauth2
jgrandja
changed the title
jgrandja
added a commit
to jgrandja/spring-security
that referenced
this issue
Oct 5, 2017
The AuthorizationCodeAuthenticationProvider implements part of the Authorization Code Grant flow as defined in OAuth 2.0 Authorization Framework and OpenID Connect Core 1.0. The implementation needs to be de-coupled to allow for better re-use and readability. This commit introduces the AuthorizationGrantAuthenticator and extracts logic from AuthorizationCodeAuthenticationProvider and provides different implementations for OAuth 2.0 and OpenID Connect 1.0. This re-factor is part of the work required for Issue spring-projectsgh-4513
jgrandja
added a commit
to jgrandja/spring-security
that referenced
this issue
Oct 5, 2017
Moved logic from AuthorizationCodeAuthenticationProvider to OAuth2UserAuthenticationProvider (new) related to loading user attributes via OAuth2UserService. This re-factor is part of the work required for Issue spring-projectsgh-4513
thomasdarimont
pushed a commit
to thomasdarimont/spring-security
that referenced
this issue
Apr 25, 2018
The AuthorizationCodeAuthenticationProvider implements part of the Authorization Code Grant flow as defined in OAuth 2.0 Authorization Framework and OpenID Connect Core 1.0. The implementation needs to be de-coupled to allow for better re-use and readability. This commit introduces the AuthorizationGrantAuthenticator and extracts logic from AuthorizationCodeAuthenticationProvider and provides different implementations for OAuth 2.0 and OpenID Connect 1.0. This re-factor is part of the work required for Issue spring-projectsgh-4513
thomasdarimont
pushed a commit
to thomasdarimont/spring-security
that referenced
this issue
Apr 25, 2018
Moved logic from AuthorizationCodeAuthenticationProvider to OAuth2UserAuthenticationProvider (new) related to loading user attributes via OAuth2UserService. This re-factor is part of the work required for Issue spring-projectsgh-4513
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
The
AuthorizationCodeAuthenticationProcessingFiltercurrently supports theoauth2Loginfeature. It handles the Authorization Response callback and processes it with it's collaborators in the following step sequence:AuthorizationCodeGrant for anAccessTokenOAuth2UserServiceto load thePrincipalinformation and ultimately authenticate the sessionStep 2 is not specified as part of the Authorization Code Grant flow in the OAuth 2.0 spec. However, we need this step in order to realize the
oauth2Loginfeature.But we also need to support the Authorization Code Grant flow as per spec for cases where the Authorized client needs to fetch a new
AccessTokento access other protected resources (after the end-user has authenticated).In order to support this,
AuthorizationCodeAuthenticationProcessingFilterandAuthorizationCodeAuthenticationProviderwill need to be re-factored.The text was updated successfully, but these errors were encountered: