Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes to refresh tokens. #15508

Merged
merged 4 commits into from
Jun 30, 2021
Merged

Fixes to refresh tokens. #15508

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fa909b7
Fix expired token error handling with non reactive application.
mshima Jun 29, 2021
9bfaef2
Don't fail when h2 console fail to start.
mshima Jun 29, 2021
ee26843
Ignore failed refresh token on reactive apps.
mshima Jun 29, 2021
33d5589
Add configuration to set oauth2 clockSkew for refresh token.
mshima Jun 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion generators/server/templates/src/main/java/package/config/OAuth2Configuration.java.ejs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
<%_ const reactivePrefix = reactive ? 'Reactive' : '' %>
package <%= packageName %>.config;

import java.time.Duration;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.<%= reactivePrefix %>OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.<%= reactivePrefix %>OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.<%= reactivePrefix %>ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.Default<%= reactivePrefix %>OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.<%= reactive ? 'server.Server' : '' %>OAuth2AuthorizedClientRepository;
Expand All @@ -16,10 +18,21 @@ public class OAuth2Configuration {
<%= reactivePrefix %>ClientRegistrationRepository clientRegistrationRepository,
<%= reactive ? 'Server' : '' %>OAuth2AuthorizedClientRepository authorizedClientRepository
) {
<%= reactivePrefix %>OAuth2AuthorizedClientManager authorizedClientManager = new Default<%= reactivePrefix %>OAuth2AuthorizedClientManager(
Default<%= reactivePrefix %>OAuth2AuthorizedClientManager authorizedClientManager = new Default<%= reactivePrefix %>OAuth2AuthorizedClientManager(
clientRegistrationRepository,
authorizedClientRepository
);

authorizedClientManager.setAuthorizedClientProvider(
<%= reactivePrefix %>OAuth2AuthorizedClientProviderBuilder
.builder()
.authorizationCode()
.refreshToken(builder -> builder.clockSkew(Duration.ofMinutes(1)))
.clientCredentials()
.password()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks strange. Why do we need a password here and where does it come from?

@bdemers Can you have a look at this? We're trying to get refresh tokens working in JHipster.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's the default for the DefaultOAuth2AuthorizedClientManager
https://github.com/spring-projects/spring-security/blob/006b9b960797d279b31cf8c8d16f1549c5632b2c/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizedClientManager.java#L91-L96

I've added to let the user easily change clockSkew, but can be removed.

.build()
);

return authorizedClientManager;
}
}
6 changes: 1 addition & 5 deletions generators/server/templates/src/main/java/package/config/WebConfigurer.java.ejs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,16 +111,12 @@ public class WebConfigurer implements <% if (!reactive) { %>ServletContextInitia
this.jHipsterProperties = jHipsterProperties;
<%_ if (devDatabaseTypeH2Any && reactive) { _%>
if (env.acceptsProfiles(Profiles.of(JHipsterConstants.SPRING_PROFILE_DEVELOPMENT))) {
<%_ if (!applicationTypeMonolith) { _%>
try {
<%_ } _%>
H2ConfigurationHelper.initH2Console();
<%_ if (!applicationTypeMonolith) { _%>
} catch (Exception e) {
// Console may already be running on another app.
// Console may already be running on another app or after a refresh.
e.printStackTrace();
};
<%_ } _%>
}
<%_ } _%>
}
Expand Down
1 change: 1 addition & 0 deletions .../templates/src/main/java/package/web/filter/OAuth2ReactiveRefreshTokensWebFilter.java.ejs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ public class OAuth2ReactiveRefreshTokensWebFilter implements WebFilter {
.filter(principal -> principal instanceof OAuth2AuthenticationToken)
.cast(OAuth2AuthenticationToken.class)
.flatMap(authentication -> authorizedClient(exchange, authentication))
.onErrorResume(e -> Mono.empty())
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should redirect to the oauth2 login here.
If the token is expired, an error is returned.

.thenReturn(exchange)
.flatMap(chain::filter);
}
Expand Down
37 changes: 34 additions & 3 deletions ...s/server/templates/src/main/java/package/web/filter/OAuth2RefreshTokensWebFilter.java.ejs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,14 @@ import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

Expand All @@ -40,16 +48,39 @@ import org.springframework.web.filter.OncePerRequestFilter;
public class OAuth2RefreshTokensWebFilter extends OncePerRequestFilter {

private final OAuth2AuthorizedClientManager clientManager;
private final OAuth2AuthorizedClientRepository authorizedClientRepository;
private final OAuth2AuthorizationRequestResolver authorizationRequestResolver;
private final RedirectStrategy authorizationRedirectStrategy = new DefaultRedirectStrategy();

public OAuth2RefreshTokensWebFilter(OAuth2AuthorizedClientManager clientManager) {
public OAuth2RefreshTokensWebFilter(
OAuth2AuthorizedClientManager clientManager,
OAuth2AuthorizedClientRepository authorizedClientRepository,
ClientRegistrationRepository clientRegistrationRepository
) {
this.clientManager = clientManager;
this.authorizedClientRepository = authorizedClientRepository;
this.authorizationRequestResolver =
new DefaultOAuth2AuthorizationRequestResolver(
clientRegistrationRepository,
OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI
);
}

@Override
public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws IOException, ServletException {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if ((authentication instanceof OAuth2AuthenticationToken)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can remove the doubled parenthesis

authorizedClient((OAuth2AuthenticationToken) authentication);
try {
OAuth2AuthorizedClient authorizedClient = authorizedClient((OAuth2AuthenticationToken) authentication);
this.authorizedClientRepository.saveAuthorizedClient(authorizedClient, authentication, request, response);
} catch (Exception e) {
OAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestResolver.resolve(request);
if (authorizationRequest != null) {
this.authorizationRedirectStrategy.sendRedirect(request, response, authorizationRequest.getAuthorizationRequestUri());
return;
}
}
}

filterChain.doFilter(request, response);
Expand Down