- The place where code is exchanged for OAuth2Tokens
ResponseEntity<OAuth2AccessTokenResponse> org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient.getResponse(RequestEntity<?> request)- Client Authentication Methods
org.springframework.security.oauth2.core.ClientAuthenticationMethod- TokenType (Bearer only one supported)
org.springframework.security.oauth2.core.OAuth2AccessToken.TokenType- OAuth2ParameterNames
org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames- OAuth2AuthorizationExchange
org.springframework.security.oauth2.core.AuthenticationMethod- OAuth2 grant types
org.springframework.security.oauth2.core.AuthorizationGrantType- OAuth2 standard claim names
org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames- client registration properties
org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesDefault Endpoints:
File: \spring-security-oauth2-authorization-server-1.0.2.jar\org.springframework.security.oauth2.server.authorization.settings\AuthorizationServerSettings.class 109: /** 110: * Constructs a new {@link Builder} with the default settings. 111: * 112: * @return the {@link Builder} 113: */ 114: public static Builder builder() { 115: return new Builder() 116: .authorizationEndpoint("/oauth2/authorize") 117: .tokenEndpoint("/oauth2/token") 118: .jwkSetEndpoint("/oauth2/jwks") 119: .tokenRevocationEndpoint("/oauth2/revoke") 120: .tokenIntrospectionEndpoint("/oauth2/introspect") 121: .oidcClientRegistrationEndpoint("/connect/register") 122: .oidcUserInfoEndpoint("/userinfo"); 123: }
File: \spring-security-oauth2-client-6.0.3.jar\org.springframework.security.oauth2.client.web\OAuth2AuthorizationCodeGrantFilter.class 186: private boolean matchesAuthorizationResponse(HttpServletRequest request) { 187: MultiValueMap<String, String> params = OAuth2AuthorizationResponseUtils.toMultiMap(request.getParameterMap());
// Where the OAuth2 response is serialized. org.springframework.security.oauth2.server.authorization.web.OAuth2TokenEndpointFilter
// WHere the request looked up and if not found returns: "invalid_request" org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter#attemptAuthentication
OAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository
.removeAuthorizationRequest(request, response);
FROM POC on Work Dell Laptop:
// Location where decision to directly redirect if there is only once registered client is made. org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer#init
Map<String, String> loginUrlToClientName = this.getLoginLinks();
if (loginUrlToClientName.size() == 1) {
// Setup auto-redirect to provider login page
// when only 1 client is configured
this.updateAuthenticationDefaults();
this.updateAccessDefaults(http);
String providerLoginPage = loginUrlToClientName.keySet().iterator().next();
this.registerAuthenticationEntryPoint(http, this.getLoginEntryPoint(http, providerLoginPage));
}
org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer#getLoginLinks
Filters:
Filter Name: filters FilterClass: com.example.authclient.AuthclientApplication$DumpFilters Filter Name: characterEncodingFilter FilterClass: org.springframework.boot.web.servlet.filter.OrderedCharacterEncodingFilter Filter Name: formContentFilter FilterClass: org.springframework.boot.web.servlet.filter.OrderedFormContentFilter Filter Name: requestContextFilter FilterClass: org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter Filter Name: springSecurityFilterChain FilterClass: org.springframework.boot.web.servlet.DelegatingFilterProxyRegistrationBean$1 any request GET / Matched org.springframework.security.web.session.DisableEncodeUrlFilter@5b5a4aed org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@2c991465 org.springframework.security.web.context.SecurityContextHolderFilter@751ae8a4 org.springframework.security.web.header.HeaderWriterFilter@58c1da09 org.springframework.security.web.csrf.CsrfFilter@7fc420b8 org.springframework.security.web.authentication.logout.LogoutFilter@7cfb4736 org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter@3c380bd8 org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter@34b87182 org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@31db34da org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@5fef2aac org.springframework.security.web.savedrequest.RequestCacheAwareFilter@4232b34a org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@101a461c org.springframework.security.web.authentication.AnonymousAuthenticationFilter@7f973a14 org.springframework.security.web.access.ExceptionTranslationFilter@2f4b98f6 org.springframework.security.web.access.intercept.AuthorizationFilter@62d1dc3c Filter Name: Tomcat WebSocket (JSR356) Filter FilterClass: org.apache.tomcat.websocket.server.WsFilter
Oauth2 Client security filter chain:
File: C:/Users/sandipChitale/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/3.1.1/14e6061a0612e3e650d8d9cb8bbae3a227635d42/spring-boot-autoconfigure-3.1.1-sources.jar!/org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2WebSecurityConfiguration.java 60: @Bean 61: SecurityFilterChain oauth2SecurityFilterChain(HttpSecurity http) throws Exception { 62: http.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated()); 63: http.oauth2Login(withDefaults()); 64: http.oauth2Client(withDefaults()); 65: return http.build(); 66: }
WHere the state parameter is checked.
deAuthenticationProvider.java 81: if (!authorizationResponse.getState().equals(authorizationRequest.getState())) { 82: OAuth2Error oauth2Error = new OAuth2Error(INVALID_STATE_PARAMETER_ERROR_CODE);