Class PasswordOAuth2AuthorizedClientProvider
- java.lang.Object
-
- org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider
-
- All Implemented Interfaces:
OAuth2AuthorizedClientProvider
@Deprecated public final class PasswordOAuth2AuthorizedClientProvider extends java.lang.Object implements OAuth2AuthorizedClientProvider
Deprecated.The latest OAuth 2.0 Security Best Current Practice disallows the use of the Resource Owner Password Credentials grant. See reference OAuth 2.0 Security Best Current Practice.An implementation of anOAuth2AuthorizedClientProvider
for thepassword
grant.- Since:
- 5.2
- See Also:
OAuth2AuthorizedClientProvider
,DefaultPasswordTokenResponseClient
-
-
Constructor Summary
Constructors Constructor Description PasswordOAuth2AuthorizedClientProvider()
Deprecated.
-
Method Summary
All Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description OAuth2AuthorizedClient
authorize(OAuth2AuthorizationContext context)
Deprecated.Attempt to authorize (or re-authorize) theclient
in the providedcontext
.void
setAccessTokenResponseClient(OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient)
Deprecated.Sets the client used when requesting an access token credential at the Token Endpoint for thepassword
grant.void
setClock(java.time.Clock clock)
Deprecated.Sets theClock
used inInstant.now(Clock)
when checking the access token expiry.void
setClockSkew(java.time.Duration clockSkew)
Deprecated.Sets the maximum acceptable clock skew, which is used when checking theaccess token
expiry.
-
-
-
Method Detail
-
authorize
@Nullable public OAuth2AuthorizedClient authorize(OAuth2AuthorizationContext context)
Deprecated.Attempt to authorize (or re-authorize) theclient
in the providedcontext
. Returnsnull
if authorization (or re-authorization) is not supported, e.g. the client'sauthorization grant type
is notpassword
OR theusername
and/orpassword
attributes are not available in the providedcontext
OR theaccess token
is not expired.The following
context attributes
are supported:OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME
(required) - aString
value for the resource owner's usernameOAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME
(required) - aString
value for the resource owner's password
- Specified by:
authorize
in interfaceOAuth2AuthorizedClientProvider
- Parameters:
context
- the context that holds authorization-specific state for the client- Returns:
- the
OAuth2AuthorizedClient
ornull
if authorization (or re-authorization) is not supported
-
setAccessTokenResponseClient
public void setAccessTokenResponseClient(OAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient)
Deprecated.Sets the client used when requesting an access token credential at the Token Endpoint for thepassword
grant.- Parameters:
accessTokenResponseClient
- the client used when requesting an access token credential at the Token Endpoint for thepassword
grant
-
setClockSkew
public void setClockSkew(java.time.Duration clockSkew)
Deprecated.Sets the maximum acceptable clock skew, which is used when checking theaccess token
expiry. The default is 60 seconds.An access token is considered expired if
OAuth2AccessToken#getExpiresAt() - clockSkew
is before the current timeclock#instant()
.- Parameters:
clockSkew
- the maximum acceptable clock skew
-
setClock
public void setClock(java.time.Clock clock)
Deprecated.Sets theClock
used inInstant.now(Clock)
when checking the access token expiry.- Parameters:
clock
- the clock
-
-