org.springframework.security.oauth2.server.resource.authentication

Class OAuth2IntrospectionAuthenticationProvider

java.lang.Object

org.springframework.security.oauth2.server.resource.authentication.OAuth2IntrospectionAuthenticationProvider

All Implemented Interfaces:

AuthenticationProvider

public final class OAuth2IntrospectionAuthenticationProvider
extends java.lang.Object
implements AuthenticationProvider

An AuthenticationProvider implementation for opaque Bearer Tokens, using an OAuth 2.0 Introspection Endpoint to check the token's validity and reveal its attributes.

This AuthenticationProvider is responsible for introspecting and verifying an opaque access token, returning its attributes set as part of the Authentication statement.

Scopes are translated into GrantedAuthoritys according to the following algorithm:

1. If there is a "scope" attribute, then convert to a Collection of Strings.
2. Take the resulting Collection and prepend the "SCOPE_" keyword to each element, adding as GrantedAuthoritys.

Since:

5.2

See Also:

AuthenticationProvider

Constructor Summary

Constructors

Constructor and Description
OAuth2IntrospectionAuthenticationProvider(java.lang.String introspectionUri, org.springframework.web.client.RestOperations restOperations) Creates a OAuth2IntrospectionAuthenticationProvider with the provided parameters
OAuth2IntrospectionAuthenticationProvider(java.lang.String introspectionUri, java.lang.String clientId, java.lang.String clientSecret) Creates a OAuth2IntrospectionAuthenticationProvider with the provided parameters

Method Summary

Modifier and Type	Method and Description
Authentication	authenticate(Authentication authentication) Introspect and validate the opaque Bearer Token.
boolean	supports(java.lang.Class<?> authentication) Returns true if this AuthenticationProvider supports the indicated Authentication object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OAuth2IntrospectionAuthenticationProvider

public OAuth2IntrospectionAuthenticationProvider(java.lang.String introspectionUri,
                                                 java.lang.String clientId,
                                                 java.lang.String clientSecret)

Creates a OAuth2IntrospectionAuthenticationProvider with the provided parameters

Parameters:

introspectionUri - The introspection endpoint uri

clientId - The client id authorized to introspect

clientSecret - The client secret for the authorized client

OAuth2IntrospectionAuthenticationProvider

public OAuth2IntrospectionAuthenticationProvider(java.lang.String introspectionUri,
                                                 org.springframework.web.client.RestOperations restOperations)

Creates a OAuth2IntrospectionAuthenticationProvider with the provided parameters

Parameters:

introspectionUri - The introspection endpoint uri

restOperations - The client for performing the introspection request

Method Detail

authenticate

public Authentication authenticate(Authentication authentication)
                            throws AuthenticationException

Introspect and validate the opaque Bearer Token.

Specified by:

authenticate in interface AuthenticationProvider

Parameters:

authentication - the authentication request object.

Returns:

A successful authentication

Throws:

AuthenticationException - if authentication failed for some reason

supports

public boolean supports(java.lang.Class<?> authentication)

Returns true if this AuthenticationProvider supports the indicated Authentication object.

Returning true does not guarantee an AuthenticationProvider will be able to authenticate the presented instance of the Authentication class. It simply indicates it can support closer evaluation of it. An AuthenticationProvider can still return null from the AuthenticationProvider.authenticate(Authentication) method to indicate another AuthenticationProvider should be tried.

Selection of an AuthenticationProvider capable of performing authentication is conducted at runtime the ProviderManager.

Specified by:

supports in interface AuthenticationProvider

Returns:

true if the implementation can more closely evaluate the Authentication class presented