Skip to content

Commit 96c90dd

Browse files
Dmitriy Dubsonjgrandja
Dmitriy Dubson
authored and
jgrandja
committed
Add OAuth2ErrorAuthenticationFailureHandler
Related gh-1369 Closes gh-1384
1 parent b3da5a7 commit 96c90dd

File tree

7 files changed

+175
-64
lines changed

7 files changed

+175
-64
lines changed

‎docs/modules/ROOT/pages/protocol-endpoints.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
167167
* `*AuthenticationConverter*` -- An `OAuth2DeviceAuthorizationRequestAuthenticationConverter`.
168168
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2DeviceAuthorizationRequestAuthenticationProvider`.
169169
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OAuth2DeviceAuthorizationRequestAuthenticationToken` and returns the `OAuth2DeviceAuthorizationResponse`.
170-
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
170+
* `*AuthenticationFailureHandler*` -- An `OAuth2ErrorAuthenticationFailureHandler` instance that handles the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
171171

172172
[[oauth2-device-verification-endpoint]]
173173
== OAuth2 Device Verification Endpoint
@@ -264,7 +264,7 @@ The supported https://datatracker.ietf.org/doc/html/rfc6749#section-1.3[authoriz
264264
* `*AuthenticationConverter*` -- A `DelegatingAuthenticationConverter` composed of `OAuth2AuthorizationCodeAuthenticationConverter`, `OAuth2RefreshTokenAuthenticationConverter`, `OAuth2ClientCredentialsAuthenticationConverter`, and `OAuth2DeviceCodeAuthenticationConverter`.
265265
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2AuthorizationCodeAuthenticationProvider`, `OAuth2RefreshTokenAuthenticationProvider`, `OAuth2ClientCredentialsAuthenticationProvider`, and `OAuth2DeviceCodeAuthenticationProvider`.
266266
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an `OAuth2AccessTokenAuthenticationToken` and returns the `OAuth2AccessTokenResponse`.
267-
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
267+
* `*AuthenticationFailureHandler*` -- An `OAuth2ErrorAuthenticationFailureHandler` instance that handles the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
268268

269269
[[oauth2-token-introspection-endpoint]]
270270
== OAuth2 Token Introspection Endpoint
@@ -311,7 +311,7 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
311311
* `*AuthenticationConverter*` -- An `OAuth2TokenIntrospectionAuthenticationConverter`.
312312
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2TokenIntrospectionAuthenticationProvider`.
313313
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OAuth2TokenIntrospectionAuthenticationToken` and returns the `OAuth2TokenIntrospection` response.
314-
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
314+
* `*AuthenticationFailureHandler*` -- An `OAuth2ErrorAuthenticationFailureHandler` instance that handles the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
315315

316316
[[oauth2-token-revocation-endpoint]]
317317
== OAuth2 Token Revocation Endpoint
@@ -358,7 +358,7 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
358358
* `*AuthenticationConverter*` -- An `OAuth2TokenRevocationAuthenticationConverter`.
359359
* `*AuthenticationManager*` -- An `AuthenticationManager` composed of `OAuth2TokenRevocationAuthenticationProvider`.
360360
* `*AuthenticationSuccessHandler*` -- An internal implementation that handles an "`authenticated`" `OAuth2TokenRevocationAuthenticationToken` and returns the OAuth2 revocation response.
361-
* `*AuthenticationFailureHandler*` -- An internal implementation that uses the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
361+
* `*AuthenticationFailureHandler*` -- An `OAuth2ErrorAuthenticationFailureHandler` instance that handles the `OAuth2Error` associated with the `OAuth2AuthenticationException` and returns the `OAuth2Error` response.
362362

363363
[[oauth2-authorization-server-metadata-endpoint]]
364364
== OAuth2 Authorization Server Metadata Endpoint

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2DeviceAuthorizationEndpointFilter.java

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,12 @@
2424

2525
import org.springframework.core.log.LogMessage;
2626
import org.springframework.http.HttpMethod;
27-
import org.springframework.http.HttpStatus;
2827
import org.springframework.http.converter.HttpMessageConverter;
2928
import org.springframework.http.server.ServletServerHttpResponse;
3029
import org.springframework.security.authentication.AbstractAuthenticationToken;
3130
import org.springframework.security.authentication.AuthenticationDetailsSource;
3231
import org.springframework.security.authentication.AuthenticationManager;
3332
import org.springframework.security.core.Authentication;
34-
import org.springframework.security.core.AuthenticationException;
3533
import org.springframework.security.core.context.SecurityContextHolder;
3634
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3735
import org.springframework.security.oauth2.core.OAuth2DeviceCode;
@@ -40,10 +38,10 @@
4038
import org.springframework.security.oauth2.core.endpoint.OAuth2DeviceAuthorizationResponse;
4139
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
4240
import org.springframework.security.oauth2.core.http.converter.OAuth2DeviceAuthorizationResponseHttpMessageConverter;
43-
import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
4441
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceAuthorizationRequestAuthenticationProvider;
4542
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceAuthorizationRequestAuthenticationToken;
4643
import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
44+
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2ErrorAuthenticationFailureHandler;
4745
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceAuthorizationRequestAuthenticationConverter;
4846
import org.springframework.security.web.authentication.AuthenticationConverter;
4947
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
@@ -76,13 +74,11 @@ public final class OAuth2DeviceAuthorizationEndpointFilter extends OncePerReques
7674
private final RequestMatcher deviceAuthorizationEndpointMatcher;
7775
private final HttpMessageConverter<OAuth2DeviceAuthorizationResponse> deviceAuthorizationHttpResponseConverter =
7876
new OAuth2DeviceAuthorizationResponseHttpMessageConverter();
79-
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
80-
new OAuth2ErrorHttpMessageConverter();
8177
private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource =
8278
new WebAuthenticationDetailsSource();
8379
private AuthenticationConverter authenticationConverter;
8480
private AuthenticationSuccessHandler authenticationSuccessHandler = this::sendDeviceAuthorizationResponse;
85-
private AuthenticationFailureHandler authenticationFailureHandler = this::sendErrorResponse;
81+
private AuthenticationFailureHandler authenticationFailureHandler = new OAuth2ErrorAuthenticationFailureHandler();
8682
private String verificationUri = OAuth2DeviceVerificationEndpointFilter.DEFAULT_DEVICE_VERIFICATION_ENDPOINT_URI;
8783

8884
/**
@@ -225,13 +221,4 @@ private void sendDeviceAuthorizationResponse(HttpServletRequest request, HttpSer
225221
this.deviceAuthorizationHttpResponseConverter.write(deviceAuthorizationResponse, null, httpResponse);
226222
}
227223

228-
private void sendErrorResponse(HttpServletRequest request, HttpServletResponse response,
229-
AuthenticationException authenticationException) throws IOException {
230-
231-
OAuth2Error error = ((OAuth2AuthenticationException) authenticationException).getError();
232-
ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
233-
httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
234-
this.errorHttpResponseConverter.write(error, null, httpResponse);
235-
}
236-
237224
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenEndpointFilter.java

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,12 @@
2727

2828
import org.springframework.core.log.LogMessage;
2929
import org.springframework.http.HttpMethod;
30-
import org.springframework.http.HttpStatus;
3130
import org.springframework.http.converter.HttpMessageConverter;
3231
import org.springframework.http.server.ServletServerHttpResponse;
3332
import org.springframework.security.authentication.AbstractAuthenticationToken;
3433
import org.springframework.security.authentication.AuthenticationDetailsSource;
3534
import org.springframework.security.authentication.AuthenticationManager;
3635
import org.springframework.security.core.Authentication;
37-
import org.springframework.security.core.AuthenticationException;
3836
import org.springframework.security.core.context.SecurityContextHolder;
3937
import org.springframework.security.oauth2.core.OAuth2AccessToken;
4038
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
@@ -44,13 +42,13 @@
4442
import org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse;
4543
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
4644
import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
47-
import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
4845
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AccessTokenAuthenticationToken;
4946
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationProvider;
5047
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationGrantAuthenticationToken;
5148
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientCredentialsAuthenticationProvider;
5249
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceCodeAuthenticationProvider;
5350
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2RefreshTokenAuthenticationProvider;
51+
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2ErrorAuthenticationFailureHandler;
5452
import org.springframework.security.oauth2.server.authorization.web.authentication.DelegatingAuthenticationConverter;
5553
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2AuthorizationCodeAuthenticationConverter;
5654
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2ClientCredentialsAuthenticationConverter;
@@ -107,13 +105,11 @@ public final class OAuth2TokenEndpointFilter extends OncePerRequestFilter {
107105
private final RequestMatcher tokenEndpointMatcher;
108106
private final HttpMessageConverter<OAuth2AccessTokenResponse> accessTokenHttpResponseConverter =
109107
new OAuth2AccessTokenResponseHttpMessageConverter();
110-
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
111-
new OAuth2ErrorHttpMessageConverter();
112108
private AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource =
113109
new WebAuthenticationDetailsSource();
114110
private AuthenticationConverter authenticationConverter;
115111
private AuthenticationSuccessHandler authenticationSuccessHandler = this::sendAccessTokenResponse;
116-
private AuthenticationFailureHandler authenticationFailureHandler = this::sendErrorResponse;
112+
private AuthenticationFailureHandler authenticationFailureHandler = new OAuth2ErrorAuthenticationFailureHandler();
117113

118114
/**
119115
* Constructs an {@code OAuth2TokenEndpointFilter} using the provided parameters.
@@ -250,15 +246,6 @@ private void sendAccessTokenResponse(HttpServletRequest request, HttpServletResp
250246
this.accessTokenHttpResponseConverter.write(accessTokenResponse, null, httpResponse);
251247
}
252248

253-
private void sendErrorResponse(HttpServletRequest request, HttpServletResponse response,
254-
AuthenticationException exception) throws IOException {
255-
256-
OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
257-
ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
258-
httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
259-
this.errorHttpResponseConverter.write(error, null, httpResponse);
260-
}
261-
262249
private static void throwError(String errorCode, String parameterName) {
263250
OAuth2Error error = new OAuth2Error(errorCode, "OAuth 2.0 Parameter: " + parameterName, DEFAULT_ERROR_URI);
264251
throw new OAuth2AuthenticationException(error);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenIntrospectionEndpointFilter.java

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,20 +24,18 @@
2424

2525
import org.springframework.core.log.LogMessage;
2626
import org.springframework.http.HttpMethod;
27-
import org.springframework.http.HttpStatus;
2827
import org.springframework.http.converter.HttpMessageConverter;
2928
import org.springframework.http.server.ServletServerHttpResponse;
3029
import org.springframework.security.authentication.AuthenticationManager;
3130
import org.springframework.security.core.Authentication;
32-
import org.springframework.security.core.AuthenticationException;
3331
import org.springframework.security.core.context.SecurityContextHolder;
3432
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3533
import org.springframework.security.oauth2.core.OAuth2Error;
36-
import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
3734
import org.springframework.security.oauth2.server.authorization.OAuth2TokenIntrospection;
3835
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenIntrospectionAuthenticationProvider;
3936
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenIntrospectionAuthenticationToken;
4037
import org.springframework.security.oauth2.server.authorization.http.converter.OAuth2TokenIntrospectionHttpMessageConverter;
38+
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2ErrorAuthenticationFailureHandler;
4139
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2TokenIntrospectionAuthenticationConverter;
4240
import org.springframework.security.web.authentication.AuthenticationConverter;
4341
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
@@ -69,9 +67,8 @@ public final class OAuth2TokenIntrospectionEndpointFilter extends OncePerRequest
6967
private AuthenticationConverter authenticationConverter;
7068
private final HttpMessageConverter<OAuth2TokenIntrospection> tokenIntrospectionHttpResponseConverter =
7169
new OAuth2TokenIntrospectionHttpMessageConverter();
72-
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter = new OAuth2ErrorHttpMessageConverter();
7370
private AuthenticationSuccessHandler authenticationSuccessHandler = this::sendIntrospectionResponse;
74-
private AuthenticationFailureHandler authenticationFailureHandler = this::sendErrorResponse;
71+
private AuthenticationFailureHandler authenticationFailureHandler = new OAuth2ErrorAuthenticationFailureHandler();
7572

7673
/**
7774
* Constructs an {@code OAuth2TokenIntrospectionEndpointFilter} using the provided parameters.
@@ -166,12 +163,4 @@ private void sendIntrospectionResponse(HttpServletRequest request, HttpServletRe
166163
this.tokenIntrospectionHttpResponseConverter.write(tokenClaims, null, httpResponse);
167164
}
168165

169-
private void sendErrorResponse(HttpServletRequest request, HttpServletResponse response,
170-
AuthenticationException exception) throws IOException {
171-
OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
172-
ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
173-
httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
174-
this.errorHttpResponseConverter.write(error, null, httpResponse);
175-
}
176-
177166
}

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2TokenRevocationEndpointFilter.java

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2022 the original author or authors.
2+
* Copyright 2020-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,17 +25,14 @@
2525
import org.springframework.core.log.LogMessage;
2626
import org.springframework.http.HttpMethod;
2727
import org.springframework.http.HttpStatus;
28-
import org.springframework.http.converter.HttpMessageConverter;
29-
import org.springframework.http.server.ServletServerHttpResponse;
3028
import org.springframework.security.authentication.AuthenticationManager;
3129
import org.springframework.security.core.Authentication;
32-
import org.springframework.security.core.AuthenticationException;
3330
import org.springframework.security.core.context.SecurityContextHolder;
3431
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
3532
import org.springframework.security.oauth2.core.OAuth2Error;
36-
import org.springframework.security.oauth2.core.http.converter.OAuth2ErrorHttpMessageConverter;
3733
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationProvider;
3834
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken;
35+
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2ErrorAuthenticationFailureHandler;
3936
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2TokenRevocationAuthenticationConverter;
4037
import org.springframework.security.web.authentication.AuthenticationConverter;
4138
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
@@ -65,10 +62,8 @@ public final class OAuth2TokenRevocationEndpointFilter extends OncePerRequestFil
6562
private final AuthenticationManager authenticationManager;
6663
private final RequestMatcher tokenRevocationEndpointMatcher;
6764
private AuthenticationConverter authenticationConverter;
68-
private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
69-
new OAuth2ErrorHttpMessageConverter();
7065
private AuthenticationSuccessHandler authenticationSuccessHandler = this::sendRevocationSuccessResponse;
71-
private AuthenticationFailureHandler authenticationFailureHandler = this::sendErrorResponse;
66+
private AuthenticationFailureHandler authenticationFailureHandler = new OAuth2ErrorAuthenticationFailureHandler();
7267

7368
/**
7469
* Constructs an {@code OAuth2TokenRevocationEndpointFilter} using the provided parameters.
@@ -157,12 +152,4 @@ private void sendRevocationSuccessResponse(HttpServletRequest request, HttpServl
157152
response.setStatus(HttpStatus.OK.value());
158153
}
159154

160-
private void sendErrorResponse(HttpServletRequest request, HttpServletResponse response,
161-
AuthenticationException exception) throws IOException {
162-
OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
163-
ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
164-
httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
165-
this.errorHttpResponseConverter.write(error, null, httpResponse);
166-
}
167-
168155
}

0 commit comments

Comments
 (0)